topic Mapping problem of users (XMLAPI) authenticated in Clearpass in General Topics

Mapping problem of users (XMLAPI) authenticated in Clearpass

Alpalo — Tue, 14 Jun 2022 09:48:59 GMT

Hi team,

The problem detected is that Palo Alto (PAN-OS 9.1.13-h3)computers register too many IPs for each user through XMLAPI (RADIUS-Clearpass origin). Usually a user is not connected to the WiFi network with more than 3 devices (work computer, personal phone and corporate phone), therefore is not associated with more than 3 IPs. In Palo Alto we find users associated to more than 20 IPs/device...

Any idea?

Regards

Re: Mapping problem of users (XMLAPI) authenticated in Clearpass

BPry — Wed, 15 Jun 2022 02:48:14 GMT

@Alpalo,

So ... what do the logs say? If you have this setup as recommended by Aruba, then ClearPass is what's actually telling the firewall how to map things through the XML API. You'll need to look at the logs on the ClearPass side of things to verify that they are updating things properly. Should be in the postauthctrl.log file as long as things haven't drastically changed since the last time I looked at it.

Re: Mapping problem of users (XMLAPI) authenticated in Clearpass

Alpalo — Wed, 15 Jun 2022 07:19:49 GMT

I am going to check the postauthctrl.log , thanks so much