Security

Hello, I am having issues integrating Palo Alto with the ClearPass Insight, our appliance is on 6.10.7 code. Each authentication record shows the Endpoint Context Server IPs. But we still do not see the XML information passing thru our Palo Alto Firewalls from Insight.  We fixed the token issue, and we can get a token string with the username and password in the url bar. We changed the password and tried a different username on the Palo Alto appliances for ClearPass but still cannot resolve the issue. We verified the network ports are open.

TAC Troubleshooting steps: 

 We are able to fetch the token. Checked the logs and it was showing the same issue asked to change the password and try and we were getting invalid credential error while testing. 

Not able to see the IP of Palo Alto in the authentication request so added the IP in the sent Login info and logout info in enforcement profile and checked the authentication. We are able to see the IP of Palo Alto in the request.
We were not able to see the any request on the Palo Alto, checked the log but could not find anything.
Started the async services and were able to see the auth request on the Palo Alto but not able to see the user id XML information.
Thank you

Hello, I have confirmed the following: 

• Insight is enabled on ClearPass - Check Enabled
  - Insight Interim accounting is enabled on ClearPass - Check Enabled

I do not see the Accounting Tab on a request details record as shown in your reply screenshot. Why would that be the case?

Thank you 

Best,

-

Do you have a wired switch? Or AP/controller?

Regardless, have you on the switch/AP/controller:

• do you see the client IP? May need client ip track, dhcp snooping or other features on wired? If the switch does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hello, I have confirmed the following: 

• Insight is enabled on ClearPass - Check Enabled
  - Insight Interim accounting is enabled on ClearPass - Check Enabled

I do not see the Accounting Tab on a request details record as shown in your reply screenshot. Why would that be the case?

Thank you 

Best,

-

Hi Herman, thank you for following this thread. I am on an Aruba Mobility campus. We have several controllers with a Master. 

Best,

Do you have a wired switch? Or AP/controller?

Regardless, have you on the switch/AP/controller:

• do you see the client IP? May need client ip track, dhcp snooping or other features on wired? If the switch does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hello, I have confirmed the following: 

• Insight is enabled on ClearPass - Check Enabled
  - Insight Interim accounting is enabled on ClearPass - Check Enabled

I do not see the Accounting Tab on a request details record as shown in your reply screenshot. Why would that be the case?

Thank you 

Best,

-

• do you see the client IP on the controller? If the controller does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hi Herman, thank you for following this thread. I am on an Aruba Mobility campus. We have several controllers with a Master. 

Best,

Do you have a wired switch? Or AP/controller?

Regardless, have you on the switch/AP/controller:

• do you see the client IP? May need client ip track, dhcp snooping or other features on wired? If the switch does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hello, I have confirmed the following: 

• Insight is enabled on ClearPass - Check Enabled
  - Insight Interim accounting is enabled on ClearPass - Check Enabled

I do not see the Accounting Tab on a request details record as shown in your reply screenshot. Why would that be the case?

Thank you 

Best,

-

Hello, thank you for your response:

• do you see the client IP on the controller? If the controller does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
  • Yes Client IP is on our controller and viewable in ClearPass
• accounting configured (required to get start-stop session information)
  •  Log accounting Interim-update Packets is set to true
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that
  • Yes, a tac case enabled interim accounting on our controllers

• do you see the client IP on the controller? If the controller does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hi Herman, thank you for following this thread. I am on an Aruba Mobility campus. We have several controllers with a Master. 

Best,

Do you have a wired switch? Or AP/controller?

Regardless, have you on the switch/AP/controller:

• do you see the client IP? May need client ip track, dhcp snooping or other features on wired? If the switch does not know the client IP, it cannot share that in the accounting information, which is what ClearPass uses to learn the client IP.
• accounting configured (required to get start-stop session information)
• interim accounting configured (required to get an update with the client IP as soon as the switch/AP/controller learns that

Hello, I have confirmed the following: 

• Insight is enabled on ClearPass - Check Enabled
  - Insight Interim accounting is enabled on ClearPass - Check Enabled

I do not see the Accounting Tab on a request details record as shown in your reply screenshot. Why would that be the case?

Thank you 

Best,

-