topic User-ID - issues with mapping from Juniper Mist wireless in General Topics

User-ID - issues with mapping from Juniper Mist wireless

ParticularNoobie — Fri, 22 Nov 2024 15:41:11 GMT

Hello.

I have issues with mapping user from Juniper Mist. User-ID is set and working fine when monitoring LAN traffic. But when I want to check wireless users I don't see Source User. From my research I understand I need some type of "bridge" between Juniper Mist and Panorama in form on syslog.
Sadly both systems are supported by separate companies so I cant ask them for help in this case.

Do anyone here have similar issue in past with Juniper Mist and Panorama? And give me any clue where I need to dig for information? Or which syslog (open source will be best) I can use as "bridge" between those two systems?

Thank you for any advices

Re: User-ID - issues with mapping from Juniper Mist wireless

BPry — Fri, 22 Nov 2024 15:53:21 GMT

@ParticularNoobie,

How are you authenticating users on the Juniper side of things? If you're using RADIUS for authentication you could just pull logs from your RADIUS server(s) directly. It's possible that you don't actually need to utilize SYSLOG scrapping depending on your authentication setup.

If you do require syslog scrapping you don't actually need to have any sort of intermediate solution. You can send SYSLOG directly to Panorama with additional information available HERE. You can also use an intermediate solution like Graylog as an open-source example that you can then have configured to update user mappings through the API easily as well. If you don't already have that setup just enabling the firewall as a listener is a more straight-forward solution however.

Re: User-ID - issues with mapping from Juniper Mist wireless

ParticularNoobie — Fri, 22 Nov 2024 16:07:57 GMT

Thank you for response BPry.
Both systems pulling info from this same Radius. That (with my knowledge) its strange. Juniper auth users by Windows AD (Radius) I can log into server and check users IP/Username for wifi. LAN users using this same Windows AD (Radius) for access desktops (docked laptops). And also I can of course log into this same server and check second vlan and see IP/Username of those users.

But Panorama showing only LAN users, and ignoring all Juniper/Wifi users.

Idea about syslog server was put in my head after conversation (with many long mails with screenshots and few life session when I explaining what is where or exactly what is missing) with our PaloAlto support as "only solution".

I hope that will bring more light on this case.

Re: User-ID - issues with mapping from Juniper Mist wireless

PavelK — Mon, 25 Nov 2024 07:29:42 GMT

Hello @ParticularNoobie

I am sorry to chime in.

Based on my past experience, Mist does not send username unless Radius accounting is enabled under: Site > Wireless > WLANs > [SSID name] > RADIUS Authentication Servers. Reference: https://www.juniper.net/documentation/us/en/software/mist/mist-wireless/topics/topic-map/radius-attributes.html.

Kind Regards

Pavel

Re: User-ID - issues with mapping from Juniper Mist wireless

ParticularNoobie — Wed, 27 Nov 2024 16:01:02 GMT

Maybe I barking on wrong tree.

Maybe syslog server is not need. And only what I need is a)change PaloAlto support company 😉 b) change settings on Group Mapping.

When I start cash I noticed that this same users (auth by GroupPolicy) sometimes are visible.. sometimes are not.
In other case - all users from BYOD network (auth by radius but with manual username/password) are not visible at all.

Maybe someone can help in this case?

I attaching screenshot created today with that issue.
One user, one computer, one destination - and we have smoke and mirrors case.

Re: User-ID - issues with mapping from Juniper Mist wireless

cdcirexx — Wed, 01 Oct 2025 17:52:33 GMT

Hello, sorry for the necro post, I'm trying to do the same, and found this 3rd party API called Pan RA proxy

https://github.com/lithnet/pan-ra-proxy

Has anyone had success running it using local radius along with a cloud ap like Mist and the PAN firewall?

Thanks in advanced.