Aruba ClearPass and User-ID

[mario11584]

We use 802.1X on our network for user authentication and assigning VLANs dynamically. Our edge switches (Brocade) and Aruba Controller are configured to use Aruba ClearPass to authenticate each user. ClearPass uses LDAP (freeIPA) to look up users. ClearPass is currently configured to pass user to IP mappings to the PA via the API. My problem is that I can't see all the users on the PA who authenticate successfully with ClearPass. I can see users authenticating in the ClearPass logs but when I check the firewall, I don't see that user's userid on the PA logs. It appears as if ClearPass is not updating the PA completely or the PA is not receiving/accepting all of the data. I am not sure if the problem is the ClearPass side or the PA side. Any ideas?

[pulukas]

You can check your configuration and test the syslog receiver with the instructions here.

How to Configure a Custom Syslog Sender and Test User Mappings

[mario11584]

Steven, thanks for that information. I followed the documentation but I am not having luck getting the new server monitor to connect. It just shows "not connected". I've tried creating a new ClearPass configuration to output syslogs to the PAs management interface and several other things, but without success.

Also, it seems this would be alternative for ip to userid mappings than the approach I was taking with having ClearPass output everything it has to the PAs API. Is that correct?

[pulukas]

Yes, this is a way to get user ip mappings via syslog directly.

Since this is not connected there is either a configuration issue on one side, or the traffic is not reaching the PA.

Do you have a way to run a span port on the PA side to confirm the syslog data is arriving?

[mario11584]

Thanks for the help Steven. We are currently analyzing traffic to see if can gather more information. I'll post again when I have more details.