Higher Education

How do you setup an alert in Insight that provide you with the following:

 

Alert you if there is more than 100 Failed Authentication within 5 minutes. The goal is the create an alert that you let you know that there might be a radius or authentication or ad issues becuase large amount of users are unable to authenticate agaist clearpass. 

 

When you use the default template in Insight: Radius Failed Authentication You can select Threshold  and Interval. However, this alert only give you the amount of failed auth Accumulated in a internal so you might get 10 or 25 failed authentication but this does not mean necessariliy that there is a problem.

 

Should i use airwave instead?

 

Thank you

Nils

Do you use Splunk? 


Thanks, 
Tim

I am currently using the free version and works great! Company hasnt bought the full subscription yet so i was wondering i can get an alert using clearpass in the meantime.

 

Thank you

You can use AirWave for now. Once you get full Splunk, there is a full ClearPass app for it. 


Thanks, 
Tim

That would be a good argument for me to convience top mgnt to release the budget. Thank you. Is there is a guide that talk about the integration of Splunk with ClearPass?

There is a technote on the support site. 


Thanks, 
Tim

If you have access to solution exchange.

https://ase.arubanetworks.com/solutions/id/70

You can easily setup the alert in insight. I will try to post a screen shot when my flight lands or if we ask really nice Tim or Victor can log into my lab and grab a screen shot of my tacacs alert. :)

See the attached screenshot that Troy was talking about. Just change it to RADIUS instead of TACACS

Thank you sir.

Thank you

 

I modified the Rule. Image attached. Just to confirm.

 

The internval means: During a 1 minute check if there is any Auth Failure

Thrreshold: Check for 5 Auth Failures

 

Am i correct?

Correct. If there is more than 5 auth fails in one min then send notice

Does anyone know how  to change the alert email date format:

 

Alert [Radius Failed Authentications] between 02/10/2015 07:19 and 02/10/2015 07:39

2015-10-02 07:23:59-04:00    mt823           err:User authentication failed
2015-10-02 07:24:26-04:00    mt823           err:User authentication failed
2015-10-02 07:25:28-04:00    mt823           err:User authentication failed
2015-10-02 07:27:24-04:00    mt823           err:User authentication failed
2015-10-02 07:29:20-04:00    mt823           err:User authentication failed
2015-10-02 07:29:50-04:00    lc599           err:User authentication failed
2015-10-02 07:30:13-04:00    mt823           err:User authentication failed

 

 

As you can see the current format is day/month/year and I would like to change it to month/day/year.

 

Nils.

It is not a changeable field.

Thank you Troy

I've been using Airwave and it works great.

'Client RADIUS Authentication Issues' for Type

Duration 5 minutes

Count >= 100

 

I have it send an e-mail.