Getting User-ID when using 802.1x Wireless

[PaulBarrington]

Hi,

I was wondering if any of you chaps and/or chapesses have come across a problem getting the correct User-ID information when using wireless authentication.

The problem I have is that I have a Palo Alto firewall that happily uses the User-ID Agent from AD/Security Event log to get User-ID information about wired connections to their network.  The customer also has an Aruba wireless network using 802.1x authentication via an NPS service backed off to their Windows AD.  Because the authentication request appears to come from the Aruba Wireless Switch, via an NPS server on the network, the information recorded in the Security event log has the relevant user with the IP address of the wireless switch.  The client device hasn't been granted any wireless network rights until it is authenticated, not even access to the DHCP server, and therefore doesn't have a IP address.

Once the client is authenticated, it is issued an IP address, which doesn't match the one in the event log and therefore the Palo Alot doesn't tie this IP address to this user.

Any assistance on this would be grateful.

[UhMayYeah]

Following solutions would be helpful in this scenario :

1> Scripting solution for User ID working with Microsoft IAS/NPS

2> The following Doc talks about Radius and User-ID integration in the environments using 802.1x devices and wireless access points and controllers.

A script can be configured to run on the Syslog server that will extract the user and IP information from the message, format it correctly for the UID-API, and then send it to the API agent.

UserID API integration using Syslog

Also check :https://live.paloaltonetworks.com/thread/7239