Security

last person joined: 3 days ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Search for Client IP Address in ClearPass

Jump to Best Answer
This thread has been viewed 16 times
  • 1.  Search for Client IP Address in ClearPass

    Posted Jun 06, 2017 10:45 AM

    Hello,

     

    I was wondering if anyone knew how to search for a client IP address in ClearPass? For instance, I want to see which client was assigned a specific IP address at a specific time. If I look in Access Tracker and click on a session I can see the "Radius:IETF:Framed-IP-Address" attribute in the RADIUS response but I cannot see a sensible way of searching for this.

     

    Any help would be appreciated.

     

    Thanks.



  • 2.  RE: Search for Client IP Address in ClearPass

    Posted Jun 06, 2017 10:55 AM
    You would use Insight to run a report.


  • 3.  RE: Search for Client IP Address in ClearPass

    Posted Jun 06, 2017 11:38 AM

    Thanks for this but when I run a report on a framed IP nowhere does it say what device was given this IP at what time etc.



  • 4.  RE: Search for Client IP Address in ClearPass

    Posted Jun 07, 2017 04:27 AM

    You have to enable radius accounting in instance. And then check in CPPM access tracker session last tab

     



  • 5.  RE: Search for Client IP Address in ClearPass

    Posted Jun 07, 2017 04:32 AM

    Yes I know I can find the Framed IP that way, but how do I search for it without sifting through thousands of entries in access tracker? Presuming I know nothing about the username, SSID etc. All I have is the IP address and want to find what user was allocated that address at a specific time?



  • 6.  RE: Search for Client IP Address in ClearPass

    Posted Jun 07, 2017 04:36 AM

    To give you the exact scenario may help....

     

    We are informed by our ISP that a copyright infringment has taken place on our network. All they can tell us about the culprit is the IP address and the time the offence took place.

     

    Is there a way to find out in Insight/CPPM who was assigned that IP    address at the specific time?

     

    Obviously CPPM has the data as I can see the IP address by looking at the Radius response but how do I search for that?



  • 7.  RE: Search for Client IP Address in ClearPass
    Best Answer

    Posted Jun 07, 2017 05:12 AM

    Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

     

    Screen Shot 2017-06-07 at 4.01.01 AM.png

     

    Screen Shot 2017-06-07 at 4.01.20 AM.png

     

    To get the full auth record you will need to include CSV.

     

     

    Screen Shot 2017-06-07 at 4.02.25 AM.png

     

    Screen Shot 2017-06-07 at 4.02.32 AM.png

     

    Here is a sameple

    Screen Shot 2017-06-07 at 4.04.11 AM.png



  • 8.  RE: Search for Client IP Address in ClearPass

    Posted Jun 07, 2017 05:15 AM

    Thanks Tarnold. Very helpful. Will certainly submit an RFE.



  • 9.  RE: Search for Client IP Address in ClearPass

    Posted Oct 11, 2021 06:24 PM
    Dear community members, 

    I know it is quite late to ask questions in this thread, myself new in clearpass !

    Just wondering, does device insight need a separate license from Aruba or our existing clearpass license will work.

    I am in the same situation where I need to find the device based on IP (noted by firewall) and came to clearpass to see who was logged in. 

    Please kindly suggest.

    Binod

    ------------------------------
    Binod Ranabhat
    ------------------------------



  • 10.  RE: Search for Client IP Address in ClearPass

    Posted Oct 12, 2021 03:07 AM
    CPPM Insight and Device insight is two different things, which did you mean? ;)

    Insight, as this thread is about, is native to CPPM and doesn't need extra license.
    Device Insight is a cloud based tool with advanced device classification using machine learning. You install collectors on your network which sends data to the cloud (Aruba Central) for analysis. Can be integrated with CPPM, but needs it's own set of licenses.

    ------------------------------
    John-Egil Solberg |
    ACMX | ACCX
    ------------------------------



  • 11.  RE: Search for Client IP Address in ClearPass

    Posted Oct 12, 2021 08:18 PM
    Thank you for clarifying this.

    The one I was talking about in clearpass was Device Insight, which is clear to me now, appreciated. 

    Where would I find CPPM insight ? And also, what it is used for primarily ? 
    Would appreciate if you can give a heads up.


    ------------------------------
    Binod Ranabhat
    ------------------------------