Configuring User-Id With Radius

[AitorGD]

Hello Dear Community,

I have a client who wants view user-id users name of the radius server on Palo Alto Logs (Like happens with LDAP Active Directory)

The SO of the Radius Server is Windows Server 2008. I saw there is a link on Palo Alto KBs to configure the user-id for Radius users from the Syslog Server:

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive...

But in this case, the customer has a Syslog but is not sending the Radius User logging to the Syslog, So I cannot apply this procedure.

Are there another form to do this?

Regards,

Aitor

[TerjeLundbo]

We use Aruba ClearPass for authentication, and there is a supported solution for integration between ClearPass and PA. Don't know if it's any help for you. It uses XML API.

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default...

[AitorGD]

Thanks for your answer.

I'm not sure if this will works on Windows Enviroment but atleast It gave me some good ideas to test a connection with the customer and get some data. Maybe with this I can build the necessary solution.

Regards,

Aitor

[OtakarKlier]

Hello,

Which RADIUS software are they using? Also does the RADIUS software log to the Security logs on the windows box?

Regards,

[AitorGD]

Hello.

Yes, I think they are logging the Radius Logs on Security Events of Windows. That something that I want to try and I am preparing, but i'm not pretty sure about how exactly works in order to configure it. Is on Server Monitoring like an active Directory? They are using the Radius Server also as User-ID agent so I think that is a good option to do it.4

Would you have some considerations about this?

Thanks!

Aitor

[OtakarKlier]

Hello,

The User-ID functionality on the PAN can map usernames to IP address's. Here are a few links to help you get started.

https://live.paloaltonetworks.com/t5/Management-Articles/User-ID-resource-list/ta-p/70379

https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-User-ID/ta-p/69321

https://live.paloaltonetworks.com/t5/Configuration-Articles/User-ID-Agent-Setup-Tips/ta-p/54755

Hope this helps.

Regards,

[AitorGD]

Hello,

Our environment is the following:

-WiFi Users authenticates against RADIUS connecting through Cisco WCS

-RADIUS server is a Windows Server 2008 R2 with NPS services. This Device is also working as user-id Agent

-Saw that users coming from WiFi Networks does not show the User-ID since they are being authenticated agaisnt Radius.

Now, the question is: How we can see the user-id names of Wi-Fi users on Palo Alto Logs. I was able to do it on my lab configuring a Radius Authentication Profile and a Radius Server (Windows 2008 R2)

The links was very usefull to build my lab, but i'm not sure about if this will work on this enviroment (The users passes for the WCS first)

Any Suggestion?

Regards,

Aitor

[TerjeLundbo]

Have a look at this article, particularly the Comments section:

https://live.paloaltonetworks.com/t5/Integration-Articles/Use-Syslog-Receiver-to-Integrate-with-Cisc...

[AitorGD]

Ok. That was very usefull. I will check that!