Security

last person joined: 2 minutes ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Check external ClearPass endpoint database

  • 1.  Check external ClearPass endpoint database

    Posted Jul 27, 2015 06:21 PM

    I have a 25k high capacity guest for external users and a 5k for internal dot1x. When connecting to the public SSID via the 25k reference the endpoint repository on the 5k to see if the mac address exists on it and if so drop the access at the 25k.  I tried this with radius proxy but the device shows up as an endpoint in the 5k.  Also have to use a radius proxy service rule which is different than generic radius.  So I tried the generic SQL database using the appexternal and I can get connected but there is a problem with my query string.  This part is still new to me.  So basically I want to check the 5k endpoint DB and is the calling station mac address exist than return the role of drop the connection.  When I trip the service I get the error Failed to get value for attributes=[mac-check-db].

     

    error.png

     

     



  • 2.  RE: Check external ClearPass endpoint database

    Posted Jul 27, 2015 06:24 PM
    Can you post the query you're using?


    Thanks,
    Tim


  • 3.  RE: Check external ClearPass endpoint database

    Posted Jul 27, 2015 07:39 PM

    Thanks for the followup.  

     

    SELECT mac FROM endpoints where mac = '%{Radius:IETF:Calling-Station-Id}';

     

     



  • 4.  RE: Check external ClearPass endpoint database

    Posted Jul 27, 2015 07:45 PM
    Can you trying using Connection:Client-Mac-Address-Lower instead of calling station ID?


    Thanks,
    Tim


  • 5.  RE: Check external ClearPass endpoint database

    Posted Jul 27, 2015 09:20 PM

    This is the information from the Alerts tab now.

     

     

    Failed to construct filter=SELECT mac FROM endpoints where mac = '%{Connection:Client-Mac-Address-Lower}';
    .
    Failed to get value for attributes=[mac-check-db]

     

    Here is how I entered it.

     

    SELECT mac FROM endpoints where mac = '%{Connection:Client-Mac-Address-Lower}';