Security

 View Only
last person joined: 17 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

ClearPass authorization based on previous switchport

This thread has been viewed 14 times

  • 1.  ClearPass authorization based on previous switchport

    Posted Dec 27, 2019 02:48 PM

    Hi!

    I have a ClearPass deployment with Cisco switches, doing MAC Auth and 802.1x in some cases. Is there a way to detect that a client has moved from one port to another? I've seen this attribute on the Access Tracker (Radius:IETF:NAS-Port-Id) but I cannot compare it to a previous successful authentication. 

     

    Please let me know if I wasn't clear enough.

     

    Thanks!

    Eric



  • 2.  RE: ClearPass authorization based on previous switchport

    EMPLOYEE
    Posted Dec 30, 2019 06:34 AM

    Did you look for Radius attribute Radius IETF NAS-Port which actual indicates the physical port number of the NAS which is authenticating the user?



  • 3.  RE: ClearPass authorization based on previous switchport

    Posted Dec 30, 2019 07:32 AM

    Hi Pavan!

    Yes, in fact that attribute is exactly what I need, but I need to compare it to a previous auth. For example, let's say yesterday I authenticated succesfully on port 4. Today, if I connect to port 3 I should be denied because "Radius IETF NAS-Port" is "3", and my last authentication was on port 4. I need to query that previous auth from somewhere.

    Thank you!

    Eric



  • 4.  RE: ClearPass authorization based on previous switchport
    Best Answer

    Posted Jan 09, 2021 07:38 PM
    Well, after some try and error I got it working. I added ClearPass DB (Postgres) as an Auth Source and figured out where the data I needed was through pgAdmin, the query that worked for me was:

    SELECT
       cast(nas_ip as VARCHAR) as prev_nas,
       CAST(attr_value as VARCHAR) as prev_port
    FROM
       tips_radius_session_log sess
       inner join tips_session_log_details det on sess.id = det.session
    WHERE
       user_name like '%{Radius:IETF:User-Name}'
       and det.attr_name = 'Radius:IETF:NAS-Port-Id'
    ORDER BY
       sess.timestamp desc limit 1

    Hope any of you find it useful!

    ------------------------------
    Eric Fahnle
    ------------------------------

    Original Message