Higher Education

Reply
This is an open group. Sign in and click the "Join Group" button to become a group member and start posting.
Highlighted
Frequent Contributor I

ClearPass Report

How do you setup an alert in Insight that provide you with the following:

 

Alert you if there is more than 100 Failed Authentication within 5 minutes. The goal is the create an alert that you let you know that there might be a radius or authentication or ad issues becuase large amount of users are unable to authenticate agaist clearpass. 

 

When you use the default template in Insight: Radius Failed Authentication You can select Threshold  and Interval. However, this alert only give you the amount of failed auth Accumulated in a internal so you might get 10 or 25 failed authentication but this does not mean necessariliy that there is a problem.

 

Should i use airwave instead?

 

Thank you

Nils

15 REPLIES
Guru Elite

Re: ClearPass Report

Do you use Splunk? 


Thanks, 
Tim

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Contributor II

Re: ClearPass Report

I've been using Airwave and it works great.

'Client RADIUS Authentication Issues' for Type

Duration 5 minutes

Count >= 100

 

I have it send an e-mail.

 

Frequent Contributor I

Re: ClearPass Report

I am currently using the free version and works great! Company hasnt bought the full subscription yet so i was wondering i can get an alert using clearpass in the meantime.

 

Thank you

Guru Elite

Re: ClearPass Report

You can use AirWave for now. Once you get full Splunk, there is a full ClearPass app for it. 


Thanks, 
Tim

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Frequent Contributor I

Re: ClearPass Report

That would be a good argument for me to convience top mgnt to release the budget. Thank you. Is there is a guide that talk about the integration of Splunk with ClearPass?

Guru Elite

Re: ClearPass Report

There is a technote on the support site. 


Thanks, 
Tim

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.

Re: ClearPass Report

If you have access to solution exchange.

https://ase.arubanetworks.com/solutions/id/70
Pasquale Monardo | Senior Network Solutions Consultant
ACDX #420 | ACCA
[If you found my post helpful, please give kudos!]

Re: ClearPass Report

You can easily setup the alert in insight. I will try to post a screen shot when my flight lands or if we ask really nice Tim or Victor can log into my lab and grab a screen shot of my tacacs alert. :)
Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Guru Elite

Re: ClearPass Report

See the attached screenshot that Troy was talking about. Just change it to RADIUS instead of TACACS

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: