we have integrated our Cisco Wireless Controller with Palo alto Firewall, the problem is that some people, authenticated successfully on the network, but the username still not appeares on Palo alto, although i can found them on the WLC, this happening with few users, not all
yes exactly, and i am creating Trap receivers which send all traps to kiwi syslog and the kiwi syslog is sending the firewall.
its depend of the Cisco WLC version.
Version 8.0 sends Traps with OID enterprise=126.96.36.199.188.8.131.52.599.0.4
Username prefix: 184.108.40.206.220.127.116.11.518.104.22.168.1.27.0=
for cisco wlc 7
try PAN agent as well to parse UserID and IP address.
Same data can be fetch from Radius.
Note: Cisco generate different OIDs for authentication (I am not expert on Cisco WLC).
Check the following documnets
You have to check the sys log messages and based on the messages. You have to select three vaules
1> Event String
These values tells to firewall that an authentication event starts from <Event string value> and the username can be fetched from <Username Prefix> and the IP address of the user is <Address Prefix>.
2013-03-20 12:56:53 local4.notice Aruba-Local3 authmgr: <522008> <NOTI> <Aruba-Local3 10.200.10.10> User Authentication Successful: username=ilija MAC=78:f5:fd:dd:ff:90 IP=10.200.27.67
Every authentication event have one string common that is "User Authentication Successful". Now the Username is "ilija" and the IP address is "10.200.27.67". We have to guide the PA firewall such that firewall can get the desired information.
Rate the helpful answer.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!