Security

Hello,

 

I was wondering if anyone knew how to search for a client IP address in ClearPass? For instance, I want to see which client was assigned a specific IP address at a specific time. If I look in Access Tracker and click on a session I can see the "Radius:IETF:Framed-IP-Address" attribute in the RADIUS response but I cannot see a sensible way of searching for this.

 

Any help would be appreciated.

 

Thanks.

You would use Insight to run a report.

Thanks for this but when I run a report on a framed IP nowhere does it say what device was given this IP at what time etc.

You have to enable radius accounting in instance. And then check in CPPM access tracker session last tab

 

Yes I know I can find the Framed IP that way, but how do I search for it without sifting through thousands of entries in access tracker? Presuming I know nothing about the username, SSID etc. All I have is the IP address and want to find what user was allocated that address at a specific time?

To give you the exact scenario may help....

 

We are informed by our ISP that a copyright infringment has taken place on our network. All they can tell us about the culprit is the IP address and the time the offence took place.

 

Is there a way to find out in Insight/CPPM who was assigned that IP    address at the specific time?

 

Obviously CPPM has the data as I can see the IP address by looking at the Radius response but how do I search for that?

Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

 

 

 

To get the full auth record you will need to include CSV.

 

 

 

 

Here is a sameple

Thanks Tarnold. Very helpful. Will certainly submit an RFE.

Dear community members, 

I know it is quite late to ask questions in this thread, myself new in clearpass !

Just wondering, does device insight need a separate license from Aruba or our existing clearpass license will work.

I am in the same situation where I need to find the device based on IP (noted by firewall) and came to clearpass to see who was logged in. 

Please kindly suggest.

Binod

------------------------------
Binod Ranabhat
------------------------------

Original Message:
Sent: Jun 07, 2017 05:11 AM
From: Troy Arnold
Subject: Search for Client IP Address in ClearPass

Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

 

 

 

To get the full auth record you will need to include CSV.

 

 

 

 

Here is a sameple

CPPM Insight and Device insight is two different things, which did you mean? ;)

Insight, as this thread is about, is native to CPPM and doesn't need extra license.
Device Insight is a cloud based tool with advanced device classification using machine learning. You install collectors on your network which sends data to the cloud (Aruba Central) for analysis. Can be integrated with CPPM, but needs it's own set of licenses.

------------------------------
John-Egil Solberg |
ACMX | ACCX
------------------------------

Original Message:
Sent: Oct 11, 2021 06:24 PM
From: Binod Ranabhat
Subject: Search for Client IP Address in ClearPass

Dear community members, 

I know it is quite late to ask questions in this thread, myself new in clearpass !

Just wondering, does device insight need a separate license from Aruba or our existing clearpass license will work.

I am in the same situation where I need to find the device based on IP (noted by firewall) and came to clearpass to see who was logged in. 

Please kindly suggest.

Binod

------------------------------
Binod Ranabhat

Original Message:
Sent: Jun 07, 2017 05:11 AM
From: Troy Arnold
Subject: Search for Client IP Address in ClearPass

Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

 

 

 

To get the full auth record you will need to include CSV.

 

 

 

 

Here is a sameple

Thank you for clarifying this.

The one I was talking about in clearpass was Device Insight, which is clear to me now, appreciated. 

Where would I find CPPM insight ? And also, what it is used for primarily ? 
Would appreciate if you can give a heads up.


------------------------------
Binod Ranabhat
------------------------------

Original Message:
Sent: Oct 12, 2021 03:06 AM
From: John Solberg
Subject: Search for Client IP Address in ClearPass

CPPM Insight and Device insight is two different things, which did you mean? ;)

Insight, as this thread is about, is native to CPPM and doesn't need extra license.
Device Insight is a cloud based tool with advanced device classification using machine learning. You install collectors on your network which sends data to the cloud (Aruba Central) for analysis. Can be integrated with CPPM, but needs it's own set of licenses.

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 11, 2021 06:24 PM
From: Binod Ranabhat
Subject: Search for Client IP Address in ClearPass

Dear community members, 

I know it is quite late to ask questions in this thread, myself new in clearpass !

Just wondering, does device insight need a separate license from Aruba or our existing clearpass license will work.

I am in the same situation where I need to find the device based on IP (noted by firewall) and came to clearpass to see who was logged in. 

Please kindly suggest.

Binod

------------------------------
Binod Ranabhat

Original Message:
Sent: Jun 07, 2017 05:11 AM
From: Troy Arnold
Subject: Search for Client IP Address in ClearPass

Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

 

 

 

To get the full auth record you will need to include CSV.

 

 

 

 

Here is a sameple