Security

Reply
al
Occasional Contributor I

Clearpass: Online Status Data Filter Not Working

I am running CPM 6.4.1.6.

 

I want to create a filter under Analysis and Trending that shows the Online Status Data of online or offline. 

 

This is the field I am referring to under Request Details for Access Tracker

Online Status.PNG

 

 

 

This is a simple Data Filter I made to test that does an OR on the two fields I beleive refer to "Online Status".

 

Online-Offline Filter.PNG

 

 

The issue is I am not returning any results. 

 

 

Thanks for any feedback.

Guru Elite

Re: Clearpass: Online Status Data Filter Not Working

The "online" status is tied to radius accounting.  Do you have your NAS sending radius accounting information in your environment to ClearPass?

 


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
al
Occasional Contributor I

Re: Clearpass: Online Status Data Filter Not Working

Thanks Joe. Yes, I can see differentiation between offline/online/disabled in access tracker.

 

I checked out the radius accounting as you suggested and thought I found it, but still not working.

 

 

When I inspect the element it looks like using "contains" offline/online should work.

Radius Offline-Online Status.PNG

 

The field I am looking in under Radius Accounting is "Acct-Status-Type"

Online-Offline Rule.PNG

Re: Clearpass: Online Status Data Filter Not Working

Do you have this enabled ?

2014-12-01 10_49_51-ClearPass Policy Manager - Aruba Networks.png

Thank you

Victor Fabian
Lead Mobility Architect @WEI
AMFX | ACMX | ACDX | ACCX | CWAP | CWDP | CWNA
al
Occasional Contributor I

Re: Clearpass: Online Status Data Filter Not Working

Yes, i do.

Am I searching the correct field now?

"RADIUS Acct-Status-Type"

Guru Elite

Re: Clearpass: Online Status Data Filter Not Working

That is not the built-in Status you are seeing. That is a RADIUS attribute. I'm not sure you can currently do what you are trying.


| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
al
Occasional Contributor I

Re: Clearpass: Online Status Data Filter Not Working

I find it odd that it's an informational field and I can't filter by it?

 

Guru Elite

Re: Clearpass: Online Status Data Filter Not Working

It's not the field you are looking for. The online status is a ClearPass calculated field. The one you are seeing is an IETF RADIUS attribute.


| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
al
Occasional Contributor I

Re: Clearpass: Online Status Data Filter Not Working

Understood thanks, if i can not filter by the calculated field is there another attribute that I can filter by that would accomplish my end goal?

Moderator

Re: Clearpass: Online Status Data Filter Not Working

Endpoint Online status is computed from InsightDb and the query is as follows:

SELECT end_time IS null AS online FROM radius_acct WHERE calling_station_id='%{Connection:Client-Mac-Address-NoDelim}' ORDER BY updated_at DESC LIMIT 1;";


Best Regards
-d

ClearPass Product Manager

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: