Security

Hi,

I have an issue with Palo Alto and Clearpass Guest Mac Caching integration.

In the first authentication (PAP – Captive Portal) everything works fine, the user is sent to Palo Alto.

The issue is in the MAC-Authentication Service, when the user returns and reauthenticates, Clearpass is sending the “mac-address” instead of "device username";

I read some integration documents (https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=14554), and I noticed that they suggest the use of “session-check / username =% {Endpoint: Username}” in the Palo Alto Enforcement Profile, as shown in the image below,

 

In the Access Tracker everything seems to be OK, follow the image below,

 

Palo Alto user-id log,

Does anyone have this scenario with this problem?

 

Thanks,

 

 

You need to follow the DOC I wrote several years back to get the USERID send to the PANW not the mac-address for the mac-auth session.

Hi Dannyjump,

 

Thanks for the quick response.

 

I read your document, it's a great guide and helped me with the integration, thanks.

 

In the document you explain exactly the problem I'm facing, and I understand that the solution is simple, and has two key points,

 

1. “Force the NAS device to send a username not a MAC address in the Interim Accounting Updates.”  Radius:IETF:Username = %{Endpoint:Username}

 

2. “The second is to use a new Session–Check attribute, as part of the PANW UserID XMLAPI update enforcement profile.” Session--‐Check::Username = %{Endpoint:Username}

 

Obs. One detail I noticed was the attribute Session--‐Check::IP--‐Addresss--‐Change--‐Notify, in version 6.8.5 this value no longer exists,

 

 

So I added the two attributes below,

_______________

 

Below are my Enforcement Profiles sent in the User Authentication and MAC-Authetication.

 

USER AUTH W/ MAC CACHING SERVICE

 

I send three key Enforcement Profiles, the first sends the Aruba-User-Role to the Aruba controller, the second updates the device attributes in the Endpoint Repository and finally sends updates to Palo Alto.

 

1. “Aruba-User-Role”

 

2. “Update Endpoint Repository”

 

3. “Send Palo Alto Update”

 

As I mentioned earlier, so far everything works fine, the user is sent to Palo Alto perfectly. Below is the information for the Mac Authentication service,

 

MAC-AUTH SERVICE

For the Mac-Authentication Service I send only two Enforcement Profiles, the first sends Aruba-User-Role to the Aruba controller and replace the default RADIUS-IETF Username (mac-address) with the Endpoint Username that was entered by the previous service, and last sends updates to Palo Alto.

 

1. “Aruba-User-Role + Change Radius:IETF::Username”

 

2. “Send Palo Alto Update”

 

In the Access Tracker on the Output tab, the result of this Enforcement Profile is the image below,

_____________________

 

I ran some tests this morning and we can see the Access Tracker and Palo Alto User-ID logs match, they are correct, but in the last logs the username should be presented instead of the mac-address.

 

ACCESS TRACKER

 

PALO ALTO USER-ID

 

Thanks,

 

 

So a couple of things.... first;y we have a new CONSOLIDATED UPDATED PANW GUIDE coming very soon that will combine the PANW Guide + Advanced Guide {that is very old as you point out :)} + GPVPN/ONGuard Guide.....

 

Now to the above, can you please expand on;

 

"I ran some tests this morning and we can see the Access Tracker and Palo Alto User-ID logs match, they are correct, but in the last logs the username should be presented instead of the mac-address"

Great news about the advanced guide.

But about the configuration and the prints above, do you have any suggestions?

I just reinforced that in the first authentication the clearpass sent the user name as expected, however in the re-authentication it is sending the mac-address of the device.

 

In the first Clearpass log at 09:48:44 I used web login, so I used the User Authentication with MAC Caching service, the user was sent to Palo Alto at 09:49:08.

 

In the last Clearpass log at 10:14:07 I forced re-authentication, so I used the MAC Authentication service, the macaddress was sent to Palo Alto at 10:14:39.

 

ACCESS TRACKER

 

PALO ALTO USER-ID

 

 

Thanks,

 

 

The quality of the images was not good. Was Solved.

Hi Danny,

 

Talking to a friend yesterday (@phk) we concluded that the problem is in the User Transformation in Administration »External Servers» Endpoint Context Servers, when we use the default option “User Transformation :: Use Full Username”, Clearpass sends the MAC address to Palo Alto.

 

PALO ALTO USER-ID

 

PALO ALTO TRAFFIC LOGS

 

The solution was to change the user transformation parameter to “User Transformation :: None” (the NetBIOS name prefix also works).

 

Changing the user transformation to None my Palo Alto Update Enforcement Profile is the same in both services, User Authentication w / Mac Caching and Mac-Authentication.

 

 

PALO ALTO USER-ID

 

PALO ALTO TRAFFIC LOGS

___________________________________________________________________________________________________

 

Another way to solve the problem using “User Transformation :: Full Username” was to create two new “Palo Alto Context Server Actions” specific to MAC-AUTH.

 

 

I just duplicated the Context Server Actions “Send Login Info” and “Send Logout Info”, and changed the attribute name = "% {user}" to name = "% {Endpoint: Username}"

 

SEND DEVICE LOGIN INFO (MAC-AUTH)

 

 

SEND DEVICE LOGOUT INFO (MAC-AUTH)

 

 

For the Enforcement Profile of the MAC-Authentication service we need to remove the original Login and Logout Context Server Actions and insert the new ones.

 

___________________________________________________________________________________________________

 

I believe that the initial solution of changing User Transformation to “User Transformation :: None” is more recommended.

 

 

Thanks!

Hello Danny,

Is there available the new guide? I'm struggling trying to configure Mac Authentication on a 6.8 CPPM and Panorama. I just see the sessions established but no mapping is seen. The configuration is fairly simple: just to see the Macs and permit specific rules for them according to the role-address group matching.

Thanks in advance for your help.

------------------------------
Jaime Pedraza
------------------------------

Original Message:
Sent: May 07, 2020 12:39 PM
From: Danny Jump
Subject: Palo Alto and Clearpass Guest Mac Caching User-ID issue

So a couple of things.... first;y we have a new CONSOLIDATED UPDATED PANW GUIDE coming very soon that will combine the PANW Guide + Advanced Guide {that is very old as you point out :)} + GPVPN/ONGuard Guide.....

 

Now to the above, can you please expand on;

 

"I ran some tests this morning and we can see the Access Tracker and Palo Alto User-ID logs match, they are correct, but in the last logs the username should be presented instead of the mac-address"

Latest Palo Alto Integration document was dated June 2020 and posted last month to: https://www.arubanetworks.com/clearpassdocs

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
------------------------------

Original Message:
Sent: Nov 11, 2020 09:50 PM
From: Jaime Pedraza
Subject: Palo Alto and Clearpass Guest Mac Caching User-ID issue

Hello Danny,

Is there available the new guide? I'm struggling trying to configure Mac Authentication on a 6.8 CPPM and Panorama. I just see the sessions established but no mapping is seen. The configuration is fairly simple: just to see the Macs and permit specific rules for them according to the role-address group matching.

Thanks in advance for your help.

------------------------------
Jaime Pedraza

Original Message:
Sent: May 07, 2020 12:39 PM
From: Danny Jump
Subject: Palo Alto and Clearpass Guest Mac Caching User-ID issue

So a couple of things.... first;y we have a new CONSOLIDATED UPDATED PANW GUIDE coming very soon that will combine the PANW Guide + Advanced Guide {that is very old as you point out :)} + GPVPN/ONGuard Guide.....

 

Now to the above, can you please expand on;

 

"I ran some tests this morning and we can see the Access Tracker and Palo Alto User-ID logs match, they are correct, but in the last logs the username should be presented instead of the mac-address"