Mapping problem of users (XMLAPI) authenticated in Clearpass

[Alpalo]

Hi team,

The problem detected is that Palo Alto (PAN-OS 9.1.13-h3)computers register too many IPs for each user through XMLAPI (RADIUS-Clearpass origin). Usually a user is not connected to the WiFi network with more than 3 devices (work computer, personal phone and corporate phone), therefore is not associated with more than 3 IPs. In Palo Alto we find users associated to more than 20 IPs/device...

Any idea?

Regards

[BPry]

@Alpalo,

So ... what do the logs say? If you have this setup as recommended by Aruba, then ClearPass is what's actually telling the firewall how to map things through the XML API. You'll need to look at the logs on the ClearPass side of things to verify that they are updating things properly. Should be in the postauthctrl.log file as long as things haven't drastically changed since the last time I looked at it. 

[Alpalo]

I am going to check the postauthctrl.log , thanks so much