topic Re: VM-100 Not recognizing users from Cisco Wireless Lan Controller in General Topics

VM-100 Not recognizing users from Cisco Wireless Lan Controller

Jack_Howells — Wed, 29 Jun 2016 08:33:53 GMT

Hi guys,

Has anyone managed to successfully have their VM-100/Palo recognise the SNMP authentication requests from the Cisco LAN Controller to use for User-ID?

I have followed the below document but to no avail.

https://live.paloaltonetworks.com/t5/Integration-Articles/Use-Syslog-Receiver-to-Integrate-with-Cisco-Wireless-Controller/ta-p/52824

This is an example of a syslog message that I'm using to put in the "Syslog Parse Profile", as described in the document.

2016-06-27 08:45:09 User.Debug wlc.vallsnet.local community=ajvrw, enterprise=1.3.6.1.4.1.9.9.599.0.4, uptime=715326600, agent_ip=10.65.100.5, version=Ver2, 1.3.6.1.4.1.9.9.599.1.3.1.1.1.0=T@'3—, 1.3.6.1.4.1.9.9.513.1.1.1.1.5.0=AP7_c067.afe4.0ae7, 1.3.6.1.4.1.9.9.599.1.3.1.1.8.0=4Ûý¬[`, 1.3.6.1.4.1.9.9.513.1.2.1.1.1.0=0, 1.3.6.1.4.1.9.9.599.1.3.1.1.10.0=10.40.99.29, 1.3.6.1.4.1.9.9.599.1.3.1.1.27.0=jespejo, 1.3.6.1.4.1.9.9.599.1.3.1.1.28.0=DADAAJV

In this case user id is = jespejo and ip address is =10.40.99.29, this ip address is assigned by dhcp.

Has anyone tried setting this up?

Kind regards
Jack

Re: VM-100 Not recognizing users from Cisco Wireless Lan Controller

Jack_Howells — Wed, 29 Jun 2016 10:03:19 GMT

Solved***

Address prefix was entered incorrectly. The below value was needed to be in place:

1.3.6.1.4.1.9.9.599.1.3.1.1.10.0=

Re: VM-100 Not recognizing users from Cisco Wireless Lan Controller

Yue.Ma — Wed, 29 Jun 2016 13:36:11 GMT

you can grab user-ip mapping secussfully? in my case, I can see PA has received log messages, but number of auth. success messages keeps none. I can not see your uploaded pic, my syslog parse profile as following,

Event String enterprise=1.3.6.1.4.1.9.9.599.0.4

Username Prefix 1.3.6.1.4.1.9.9.599.1.3.1.1.27.0=

Username Delimiter ,\s

Address Prefix 1.3.6.1.4.1.9.9.599.1.3.1.1.10.0=

Address Delimiter ,\s

Re: VM-100 Not recognizing users from Cisco Wireless Lan Controller

Yue.Ma — Sat, 16 Jul 2016 11:36:12 GMT

Does anyone have similar experience ?