Disclaimer
This document is intended as an easy example on how to leverage action oriented and selective log forwarding in PAN-OS 8.0, not as a comprehensive solution document.
Goal
This document summarizes the information and relevant steps to integrate Palo Alto Networks Next-Generation Firewalls with Aruba Instant Access Points to automatically disconnect and blacklist a device from the wireless network based on something detected by the firewall (use of an application, access to a honeypot, C&C, vulnerability exploits, etc).
This can be done with Panorama and Aruba ClearPass to apply to larger implementations, but for simplicity I used a single firewall with a single IAP.
Action-Oriented Log Forwarding using HTTP
To enable better integration between your firewall and IT infrastructure, PAN‐OS 8.0 gives you the ability to trigger an action or initiate a workflow to an external HTTP‐based service, when a log is generated on the firewall. You can now forward logs from the firewall or Panorama to an HTTP(S) destination to accomplish the following task more easily.
Send an HTTP‐based API request directly to a third‐party service to trigger an action based on the attributes in a firewall log. You can configure the firewall to work with any HTTP‐based service that exposes an API, and modify the URL, HTTP header, parameters, and the payload in the HTTP request to meet your integration needs. This capability when used with the Selective Log Forwarding Based on Log Attributes allows you to forward logs that match a defined criteria so that you can automate a workflow or an action; you do not need to rely on an external system to convert syslog messages or SNMP traps to an HTTP request.
ARUBA IAP API
ArubaOS allows you to set up customized external captive portal user management using its native XML API interface. The XML API interface allows you to create and execute user management operations seamlessly onbehalf of the clients or users. You can use the XML API interface to add, delete, authenticate, or query a user or a client.
Create an XML request with an appropriate authentication command and send it to the controller via HTTPS post. The format of the URL to send the XML request is:
https://<controller-ip/auth/command.xml
In which,
controller-ip is the IP address of the controller that will receive the authentication request
xmlis the XML request that contains the details of authentication.
The format of the XML API request is:
xml=<aruba command="<authentication_command>">
<options>Value</options>
...
<options>Value</options>
</aruba>
You can specify any of the following commands in the XML request:
Table 1 XML API Authentication Command
Authentication Command
Description
user_add
This command adds the user to the controllers user table.
user_delete
This command deletes the user from the controller
user_authenticate
This command will authentication the user based on the authentication rules defined in the controllers configuration.
user_blacklist
This command will block a user from connection to your network.
user_query
This command will display the current status of the user connected to your network.
The authentication command requires certain mandatory options to successfully execute the authentication tasks. The list of all available options are:
Table 2 Authentication command options
Options
Description
Range / Defaults
ipaddr
IP address of the user in A.B.C.D format.
—
macaddr
MAC address of the user aa:bb:cc:dd:ee:ff format.
Enter MAC address with colon.
user
Name of the user.
64 character string
role
Role name assigned after authenticating.
64 character string
password
The password of the user used for authentication.
—
session_timeout
Session time-out in minutes. User will be disconnected after this time.
—
authentication
Authentication method used to authenticate the message and the sender. You can use any of MD5, SHA-1 or clear text methods of authentication. This option is ignored if shared secret is not configured. It is, however, mandatory if it is configured.
—
key
This is the encoded SHA1/MD5 hash of shared secret or plaintext shared secret.
This option is ignored if shared secret is not configured on the switch.
The actual MD5/SHA-1 hash is 16/20 bytes and consists of binary data. It must be encoded as an ASCII based HEX string before sending. It must be present when the controller is configured with an xml-api key for the server. Encoded hash length is 32/40 bytes for MD5/SHA-1.
version
The version of the XML API interface available in the controller. This field is mandatory is all requests.
Current version 1.0
Palo Alto Networks Next-Generation Firewall Configuration Steps
Follow the firewall quick start guide to get a working environment where traffic from wireless users is traversing the firewall and logs are being generated.
Create an HTTP Server Profile and add the IAP IP address with protocol HTTPS, port 443 and HTTP Method POST
Define the payload format for all relevant log types
xml=<aruba command="user_blacklist">
<ipaddr>$src</ipaddr>
<authentication>cleartext</authentication>
<key>shared-key</key>
<version>1.0</version>
</aruba>
Create a Log Forwarding Profile with a match list and select the HTTP server profile created earlier.
Create a filter and assign it to the Log Forwarding Profile. In the example I have used a URL match to simplify the testing. Once it is working you can define an appropriate filter to match what is required on your environment.
Apply the log forwarding profile to the rule/s that allow traffic from the wireless network
Aruba Instant Access Point Configuration Steps
Follow Aruba instructions to get a working IAP with at least one SSID
Enable Blacklisting on the SSID
Configure the XML API server from More – Services – Network Integration, using the firewall management IP address and the shared-key. The Palo Alto Network firewall integration is optional and not required (but recommended)
Configure the blacklisting timeouts
Assign a certificate to the IAP captive portal that is trusted by the firewall (you can create a trusted CA in the firewall and generate the certificate for the IAP)
Testing the Integration
You can send a test log from the http server profile payload format definition
$src won’t resolve to the actual source IP address, but $src can be manually replaced with a testing client IP (a commit is required before sending the test log)
A blacklisted client is immediately disconnected from the wireless and it will show under Info
Created by Mauricio Sabena
... View more