topic XML API user-id timeouts is there a configurable global setting ? in General Topics

XML API user-id timeouts is there a configurable global setting ?

Infra_SRV — Fri, 14 Oct 2016 06:47:10 GMT

Can you set a global timeout value for XML API user-id timeouts is there a configurable global timeout ?

We are useing clearpass 6.6 to authenticate our wireless users and using technote v5 clearpass palo alto integration to push user name and ip address via post authentication action via xlmapi. Only after upgrading to 7.1.5 form 7.1.4-h2 we saw that user-id cache timeouts were changed from never to 45 minutes. We didn't realise this before. It would be nice to have a global setting that you can set for xmlapi user-id timoutes in the cache. As there isn't a way to set this in clearpass to pass along to xmlapi as far as we know.

Re: XML API user-id timeouts is there a configurable global setting ?

Brandon_Wertz — Tue, 27 Jun 2023 13:02:30 GMT

I recently had this very issue and there's 2 ways to fix it. By default Aruba ClearPass doesn't send a timeout value to Panorama for authenticated sessions, it assumes you want to use the locally configured timeout value on Panorama (firewalls) which is in:

Device --> User-Identification --> (Gear/Setting Icon) --> User Mapping --> Cache

If you want the timeout value to be set via XML from Aruba add timeout="XXXX" (where X = number of minutes for the FW to store the user to IP association) string the XML code being sent to the FW.

This KB shows an example: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXyCAK