topic Re: Aruba AP with PAN, User-ID mapping with IP, Syslog Filters in General Topics

Aruba AP with PAN, User-ID mapping with IP, Syslog Filters

ZhenGuo — Thu, 27 Aug 2020 11:41:57 GMT

I'm trying to map User-ID to IP in our intranet so that we could easily identify User in PAN Traffic.

We have Aruba APs adn AC authenticating with external Radius Server, While our PAN is sitting at the gateway.

What i'm trying to do is using Aruba AC sending debug level logs to PAN, PAN could use Syslog Filters to filter our the mapping.

I'm wondering Anyone have ever done that succuessfully?

Thanks

Re: Aruba AP with PAN, User-ID mapping with IP, Syslog Filters

alowther_chatham — Fri, 28 Aug 2020 19:43:57 GMT

Not sure about "AC", but I use Aruba Instant clusters. I integrate user-id with PaloAlto two ways.

First, there is a native integration option

https://www.arubanetworks.com/techdocs/Instant_40_Mobile/Advanced/Content/UG_files/RTLS_conf/panFirewallInt.htm

Second, a syslog filter on the PaloAlto

Event Regex: User [aA]uthenticat(?:ed|ion)

Username Regex: username[-=]([a-zA-Z0-9\\._-]+)

Address Regex: [iI][pP][-=]([0-9.]+)

The syslog filter a backup in case the native integration fails. I am currently trying to report a bug with the native integration where the Aruba will use the PaloAlto API to send a logout followed immediately by a login for an IP. This often results in the login update not taking effect.

Re: Aruba AP with PAN, User-ID mapping with IP, Syslog Filters

ZhenGuo — Tue, 22 Sep 2020 09:54:33 GMT

we don't have any integration on Windows.

Only Aruba AP, AC and PAN 850. I have tried with various Syslog Filter settings , but still nothing shows in Monitoring about Source User.

I checked debug log in Aruba AC (Local), i could see all those '<NOTI> |authmgr| User Authentication Successful' logs, but can't reflect on PAN. no idea where set wrong.

Re: Aruba AP with PAN, User-ID mapping with IP, Syslog Filters

alowther_chatham — Fri, 25 Sep 2020 17:43:55 GMT

I'm not sure why you are mentioning Windows. The native integration is where the Aruba Instant controller will directly update a PaloAlto device using the PaloAlto API.

Impossible to say what is wrong. Some troubleshooting tasks that jump to mind

- Do a packet capture on the firewall to see if the syslog messages are arriving

- Check logs. System logs in the UI. From the command line there are mp-log files for useridd.log and syslog-ng.log that could be useful.

- Verify under User Identification that the server sending the syslog messages is configured as a Monitored Server with your regex profile

- Verify the interface receiving the syslog messages has an Interface Management Profile that allows the User-ID Syslog Listener