topic Re: Configuring User-Id With Radius in General Topics

Configuring User-Id With Radius

AitorGD — Tue, 04 Apr 2017 07:36:25 GMT

Hello Dear Community,

I have a client who wants view user-id users name of the radius server on Palo Alto Logs (Like happens with LDAP Active Directory)

The SO of the Radius Server is Windows Server 2008. I saw there is a link on Palo Alto KBs to configure the user-id for Radius users from the Syslog Server:

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive-user-mappings-from-a-syslog-sender.html

But in this case, the customer has a Syslog but is not sending the Radius User logging to the Syslog, So I cannot apply this procedure.

Are there another form to do this?

Regards,

Aitor

Re: Configuring User-Id With Radius

TerjeLundbo — Tue, 04 Apr 2017 10:08:12 GMT

We use Aruba ClearPass for authentication, and there is a supported solution for integration between ClearPass and PA. Don't know if it's any help for you. It uses XML API.

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=17560

Re: Configuring User-Id With Radius

AitorGD — Tue, 04 Apr 2017 14:08:17 GMT

Thanks for your answer.

I'm not sure if this will works on Windows Enviroment but atleast It gave me some good ideas to test a connection with the customer and get some data. Maybe with this I can build the necessary solution.

Regards,

Aitor

Re: Configuring User-Id With Radius

OtakarKlier — Tue, 04 Apr 2017 15:27:27 GMT

Hello,

Which RADIUS software are they using? Also does the RADIUS software log to the Security logs on the windows box?

Regards,

Re: Configuring User-Id With Radius

AitorGD — Thu, 06 Apr 2017 19:51:10 GMT

Hello.

Yes, I think they are logging the Radius Logs on Security Events of Windows. That something that I want to try and I am preparing, but i'm not pretty sure about how exactly works in order to configure it. Is on Server Monitoring like an active Directory? They are using the Radius Server also as User-ID agent so I think that is a good option to do it.4

Would you have some considerations about this?

Thanks!

Aitor

Re: Configuring User-Id With Radius

OtakarKlier — Thu, 06 Apr 2017 20:22:14 GMT

Hello,

The User-ID functionality on the PAN can map usernames to IP address's. Here are a few links to help you get started.

https://live.paloaltonetworks.com/t5/Management-Articles/User-ID-resource-list/ta-p/70379

https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-User-ID/ta-p/69321

https://live.paloaltonetworks.com/t5/Configuration-Articles/User-ID-Agent-Setup-Tips/ta-p/54755

Hope this helps.

Regards,

Re: Configuring User-Id With Radius

AitorGD — Tue, 18 Apr 2017 07:22:50 GMT

Hello,

Our environment is the following:

-WiFi Users authenticates against RADIUS connecting through Cisco WCS

-RADIUS server is a Windows Server 2008 R2 with NPS services. This Device is also working as user-id Agent

-Saw that users coming from WiFi Networks does not show the User-ID since they are being authenticated agaisnt Radius.

Now, the question is: How we can see the user-id names of Wi-Fi users on Palo Alto Logs. I was able to do it on my lab configuring a Radius Authentication Profile and a Radius Server (Windows 2008 R2)

The links was very usefull to build my lab, but i'm not sure about if this will work on this enviroment (The users passes for the WCS first)

Any Suggestion?

Regards,

Aitor

Re: Configuring User-Id With Radius

TerjeLundbo — Tue, 18 Apr 2017 09:48:01 GMT

Have a look at this article, particularly the Comments section:

https://live.paloaltonetworks.com/t5/Integration-Articles/Use-Syslog-Receiver-to-Integrate-with-Cisco-Wireless-Controller/ta-p/52824

Re: Configuring User-Id With Radius

AitorGD — Tue, 18 Apr 2017 13:39:42 GMT

Ok. That was very usefull. I will check that!