Security

Hello,

We run a captive portal Guest SSID which is set up on ClearPass (social login (including Azure) or self-reg). Our AOS cluster (with conductor and standby conductor) is running 8.10.0.8

We have a requirement to treat a subset of our Guest users differently (probably by S-NAT'ing them to a specific address(es)), this is to allow those particular users access to journals that have IP based access restrictions (not our design!)).

Identifying them is no problem - they are members of a particular group in Azure AD, so our plan was for the ClearPass service to match on that group and give them a special role, and then use a NAT rule in that role on AOS to have the controller NAT them. However we must log the translations and we aren't sure if AOS will do that (we also need to keep those records for 90 days). Does anyone know if that logging is possible on AOS?

If AOS can't do this for us then another possibility might be to see if ClearPass can integrate with our Fortigate firewall in a dynamic per-user way that could achieve the same result - does anyone have any experience of doing something like that?

Or we're certainly open to other suggestions. At the moment our default fallback will be to broadcast a separate SSID for these users, which would do the job, but we'd prefer to avoid if we can.

Guy

I think you should be able to perform the action src-nat and then use extended action of "log"

ip access-list session <accname>
<source> <dest> <service> <action> [<extended action>]
ipv6 <source> <dest> <service> <action> [<extended action>]

you can refer to the CLI user guide here 

search for "ip access-list session"

Hello,

We run a captive portal Guest SSID which is set up on ClearPass (social login (including Azure) or self-reg). Our AOS cluster (with conductor and standby conductor) is running 8.10.0.8

We have a requirement to treat a subset of our Guest users differently (probably by S-NAT'ing them to a specific address(es)), this is to allow those particular users access to journals that have IP based access restrictions (not our design!)).

Identifying them is no problem - they are members of a particular group in Azure AD, so our plan was for the ClearPass service to match on that group and give them a special role, and then use a NAT rule in that role on AOS to have the controller NAT them. However we must log the translations and we aren't sure if AOS will do that (we also need to keep those records for 90 days). Does anyone know if that logging is possible on AOS?

If AOS can't do this for us then another possibility might be to see if ClearPass can integrate with our Fortigate firewall in a dynamic per-user way that could achieve the same result - does anyone have any experience of doing something like that?

Or we're certainly open to other suggestions. At the moment our default fallback will be to broadcast a separate SSID for these users, which would do the job, but we'd prefer to avoid if we can.

Guy

Thank you, I'll give that a try and see if the logging includes what we need.

I think you should be able to perform the action src-nat and then use extended action of "log"

ip access-list session <accname>
<source> <dest> <service> <action> [<extended action>]
ipv6 <source> <dest> <service> <action> [<extended action>]

you can refer to the CLI user guide here 

search for "ip access-list session"

Hello,

We run a captive portal Guest SSID which is set up on ClearPass (social login (including Azure) or self-reg). Our AOS cluster (with conductor and standby conductor) is running 8.10.0.8

We have a requirement to treat a subset of our Guest users differently (probably by S-NAT'ing them to a specific address(es)), this is to allow those particular users access to journals that have IP based access restrictions (not our design!)).

Identifying them is no problem - they are members of a particular group in Azure AD, so our plan was for the ClearPass service to match on that group and give them a special role, and then use a NAT rule in that role on AOS to have the controller NAT them. However we must log the translations and we aren't sure if AOS will do that (we also need to keep those records for 90 days). Does anyone know if that logging is possible on AOS?

If AOS can't do this for us then another possibility might be to see if ClearPass can integrate with our Fortigate firewall in a dynamic per-user way that could achieve the same result - does anyone have any experience of doing something like that?

Or we're certainly open to other suggestions. At the moment our default fallback will be to broadcast a separate SSID for these users, which would do the job, but we'd prefer to avoid if we can.

Guy

As ariyap has mentioned you can use a source NAT policy at the end of the new guest user role, enable log to have the ACL hits logged.

Since you are doing the authentication on ClearPass, you may want to configure a ClearPass Insight report. This should give you much more information / accounting. 

Original Message:
Sent: Sep 16, 2023 04:13 AM
From: cauliflower
Subject: NATing certain users on Guest to a particular address/subnet AOS/ClearPass/Fortigate

Thank you, I'll give that a try and see if the logging includes what we need.

Original Message:
Sent: Sep 15, 2023 10:48 PM
From: ariyap
Subject: NATing certain users on Guest to a particular address/subnet AOS/ClearPass/Fortigate

I think you should be able to perform the action src-nat and then use extended action of "log"

ip access-list session <accname>
<source> <dest> <service> <action> [<extended action>]
ipv6 <source> <dest> <service> <action> [<extended action>]

you can refer to the CLI user guide here 

search for "ip access-list session"

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.

Original Message:
Sent: Sep 15, 2023 01:50 PM
From: cauliflower
Subject: NATing certain users on Guest to a particular address/subnet AOS/ClearPass/Fortigate

Hello,

We run a captive portal Guest SSID which is set up on ClearPass (social login (including Azure) or self-reg). Our AOS cluster (with conductor and standby conductor) is running 8.10.0.8

We have a requirement to treat a subset of our Guest users differently (probably by S-NAT'ing them to a specific address(es)), this is to allow those particular users access to journals that have IP based access restrictions (not our design!)).

Identifying them is no problem - they are members of a particular group in Azure AD, so our plan was for the ClearPass service to match on that group and give them a special role, and then use a NAT rule in that role on AOS to have the controller NAT them. However we must log the translations and we aren't sure if AOS will do that (we also need to keep those records for 90 days). Does anyone know if that logging is possible on AOS?

If AOS can't do this for us then another possibility might be to see if ClearPass can integrate with our Fortigate firewall in a dynamic per-user way that could achieve the same result - does anyone have any experience of doing something like that?

Or we're certainly open to other suggestions. At the moment our default fallback will be to broadcast a separate SSID for these users, which would do the job, but we'd prefer to avoid if we can.

Guy