topic Re: multiple users same machine privileges crossed in General Topics

multiple users same machine privileges crossed

dthibodeaux — Mon, 06 Oct 2014 17:11:58 GMT

currently have a customer using radius authentication on the wireless and user-id on the PA. The problem is when two different users use the same machine. Teacher logs in and gets a policy applied to the session going through the firewall and she logs out and a student logs in to the same machine, that student has the same privileges through the PA as the teacher did. It seems like the PA is not releasing the session and applying the correct policy to the new user. Any ideas?

setup is HA-3020's and Aruba wireless. Radius auth is against microsoft 2012 server

Thanks!

Re: multiple users same machine privileges crossed

bat — Mon, 06 Oct 2014 17:16:20 GMT

dthibodeaux

Do you see the (student) user name in the traffic logs when it hits the policy that you have created for teacher ?

If not, please verify if the ip-user-mapping changes for that IP address after teacher logs out and student logs in.

You can check the ip-user-mapping for an IP using the following command:

show user ip-user-mapping ip <ip/netmask>

Re: multiple users same machine privileges crossed

hshah — Mon, 06 Oct 2014 17:17:20 GMT

Hi Dhibodeaux,

Actually this should not happen, because when user logs out, it creates a security log on AD server. Firewall reads it and remove the mapping. We should try to find out why its not happenning.

However, there are two solution for this.

1. Reduce Timeout interval for user-id to ip mapping. - Which means older mappings will expire if there is no activity from them.

2. Or enable WMI probing - User-id agent queries all active users, if they dont respond. Its removed.

Regards,

HArdik Shah:

Re: multiple users same machine privileges crossed

dthibodeaux — Mon, 06 Oct 2014 17:46:40 GMT

ok so some more info

This is only happening on wireless users....wired works fine. we are not seeing a user/ip mapping for the wireless users...the source user is blank

Is there some new feature in 6.0 to help with this?

Re: multiple users same machine privileges crossed

bat — Mon, 06 Oct 2014 17:56:44 GMT

dthibodeaux

Source user field is blank due to the username not being pushed correctly, how are you pushing the usernames from the Aruba wireless ? Are you using XML API ?

Re: multiple users same machine privileges crossed

dthibodeaux — Mon, 06 Oct 2014 17:58:31 GMT

I'm guessing I'm not...:smileyconfused:

Re: multiple users same machine privileges crossed

bat — Mon, 06 Oct 2014 18:18:41 GMT

There are multiple methods to push user ip mappings:

--Using a syslog parser profile:

How to Collect the User-IP Mappings from a Syslog Sender Using an User-ID Agent

--Using XML API:

https://paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/technology-solutions-briefs/aruba.pdf

http://www.arubanetworks.com/wp-content/uploads/TechNote_ArubaAndPaloAltoNetworksIntegration.pdf

Hope it helps !

Re: multiple users same machine privileges crossed

Retired Member — Mon, 06 Oct 2014 18:48:45 GMT

you have to use api or the new syslog feature as mentioned.

Re: multiple users same machine privileges crossed

dthibodeaux — Wed, 08 Oct 2014 15:04:31 GMT

ok so this customer does not have clear pass so I am assuming the xml api solution wont work...as far as the syslog solution, I am trying to set this up in my lab. I have a aruba controller, pa200, and 2008 server. Do I run the syslog server on the same server as the user-id agent is on or do these need to be separate boxes? I am running kiwi syslog server on the same 2008 server as the UID agent is on...think I said that already

The document keeps referring to a "syslog sender" and I am not sure if that is the controller, the PA, or the 2008 server.

Thanks

David

Re: multiple users same machine privileges crossed

bat — Wed, 08 Oct 2014 16:23:54 GMT

dthibodeaux

Syslog sender should be aruba controller which should be sending login/logout events to pa200. On pa200 you should have syslog parser profile to parse these logs and extract the User to IP information.

Re: multiple users same machine privileges crossed

dthibodeaux — Wed, 08 Oct 2014 18:22:11 GMT

I did finally get this to work using the user-id agent setup on the PA itself but my concern is how taxing this might be to the box in a production environment. I would really like it to work using the user-id agent on the domain controller. For some reason I cannot get the info from the DC to the PA for the wireless users. I have the Aruba pointing at the DC where the agent resides, I have the agent setup with the sender info but never see the user info on the PA in the monitor logs. any ideas?

Re: multiple users same machine privileges crossed

dthibodeaux — Fri, 10 Oct 2014 13:59:07 GMT

ok I got it working using the UID agent residing on the DC.

Thanks for all the info!!