VPN Cisco concentrator/ISE - USER-ID log to PA

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

VPN Cisco concentrator/ISE - USER-ID log to PA

L4 Transporter

USER-ID log from VPN Cisco concentrator

 

Dear Live community, how is everything going ?

 

Have you ever had to do the following?

 

We have to integrate a Cisco ASA, with Palo Alto, so that the PA receives from a Cisco ASA and/or Cisco ISE the users to be able to have mapper with USER-ID the users that connect by VPN. ( There is no global protect )

 

Details:

Cisco ASA --- Cisco ISE ( AAA ) users with any connect - Flows through PA.

 

They want the Palo Alto firewalls to be able to read the users that when a user connects via VPN to the Cisco ASA, the Palo Alto FW receives the information from the Cisco ASA and/or the Cisco ISE on the PA, so that the User-ID can somehow get that information from those users.

 

Clarifications, the PA does not have and should not use Global Protect. The Palo Alto FW must receive the information from the Cisco ASA and/or Cisco ISE when VPN users connect, Palo Alto can map them and see them in the User Log fields of the PA when traffic passes through it.

 

Please can you guide me and/or indicate me how to achieve this goal, at least as a base, limitations, considerations and/or guide to achieve this issue.

 

Thanks for your time and collaboration

 

I remain attentive

 

Best regards

High Sticker
6 REPLIES 6

Cyber Elite
Cyber Elite

Hi @Metgatz ,

 

You can configure ISE to send syslog data to a NGFW which parses User-ID info.  It works great.  https://live.paloaltonetworks.com/t5/general-topics/cisco-ise-integration-for-userid/m-p/381362

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Hi @TomYoung , thank you very much for your time and thanks for your advice.

 

Yes, the issue here is also in the filtering needed for the

Log-In and Log-OFF.

 

So yes in this case I would also need that information from the ISE.

 

Now that I see it, I doubt that this information is sent from the ISE, maybe the login or that the connection was validated from the ASA to the ISE to authenticate and validate the user and already indicates OK, I am not sure if when the Cisco Anyconnect client exits the ASA, the ASA indicates to the ISE that the user released the session and performed the log-off.

Because if not, I would only apply the User Identification Timeout (default 45 min) to release the user mapping, thinking that I will only have the login or the successful validation of the ISE, but not the logoff.

 

User Identification Timeout (min)

Set the timeout value in minutes for user mapping entries (range is 1 to 3,600; default is 45).

 

What do you think, any advice, recommendation or detail to consider ?

 

I remain attentive

 

Best regards

High Sticker

Cyber Elite
Cyber Elite

Hi @Metgatz ,

 

What specific issue do you have?  Is the NGFW showing the User-ID mappings for the ASA AnyConnect users?

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Cyber Elite
Cyber Elite

Hello @Metgatz

 

we have implemented IP-User mapping from AnyConnect clients by parsing ASA logs. For AnyConnect session connection and disconnection there are below syslog messages generated.

 

746012
Error Message %ASA-5-746012: user-identity: Add IP-User mapping IP Address - domain_name \user_name result - reason
Explanation: A new user-IP mapping has been added to the user-to-IP address mapping database. The status of the operation (success or failure) is indicated. The success reason is VPN user. The failure reasons include the following: Maximum user limit reached and Duplicated address.

 

746013
Error Message %ASA-5-746013: user-identity: Delete IP-User mapping IP Address - domain_name \user_name result - reason
Explanation: A change has been made to the user-to-IP address mapping database. The status of the operation (success or failure) is indicated. The success reasons include the following: Inactive timeout, NetBIOS probing failed, PIP notification, VPN user logout, Cut-through-proxy user logout, and MAC address mismatch. The failure reason is PIP notification.

 

In our case this works well to update User-ID mapping in Firewalls.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi @PavelK thanks for your reply.

 

Excellent, yes that's exactly what I'm looking for. I was already looking at those logs and yes, there I will have both login and logout. From the ISE I will not have the logout versus the ASA log for both cases. This way sounds better.

 

Please if it was not too much bother and waiting for your help and collaboration, could you share the Regex or Field that you used in the syslog parse profile for both the LogIn event and the LogOut, only generically, without sharing anything sensitive, and then I adjust them to what I need, but if you could share the ones you used, that are working in the environment that you mention that works without problems, I would appreciate it very much.

 

Thanks for your time, advice and collaboration

 

I remain attentive

 

Best regards

High Sticker

Cyber Elite
Cyber Elite

Hello @Metgatz

 

I am sorry for late response. This has been set years ago and I have in meanwhile moved to different position. Please give me some time to research it.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.
  • 1208 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!