topic Re: To send Radius AAA request To ISE Cisco in Firewall and Security Management

To send Radius AAA request To ISE Cisco

Franck-Elie_Chi — Fri, 14 Dec 2018 09:42:30 GMT

Hello,

my problem is as follow:

I created an Identity Awarness on CheckPoint R77.30, It works well.

But when I'm authenticated, I can see my logs on an ISE Cisco and in my log I see my username who is authenticated with token in my my captive portal but I never see my IP ADDRESS...

Please I need to see my ip address so could you help me?

Maybe I forgot something in CheckPoint configuration...

Re: To send Radius AAA request To ISE Cisco

PhoneBoy — Fri, 14 Dec 2018 14:15:12 GMT

What specific log are you expecting to find the IP in?

It should definitely show in the Check Point logs…

Re: To send Radius AAA request To ISE Cisco

Franck-Elie_Chi — Fri, 14 Dec 2018 14:17:40 GMT

Yes but I need to get it on My ISE cisco radius livelogs but I just get the nas ip address (checkpoint ip).

Re: To send Radius AAA request To ISE Cisco

PhoneBoy — Fri, 14 Dec 2018 18:48:24 GMT

The whole point of the Cisco ISE integration is to utilize the information Cisco ISE provides automatically.

More specifically, you shouldn't have to use Captive Portal.

When we have to authenticate the user using Captive Portal, we don't pass the client IP address to the remote server.

The correct steps to integrate are described in the Identity Awareness documentation.

Re: To send Radius AAA request To ISE Cisco

Franck-Elie_Chi — Mon, 17 Dec 2018 07:31:18 GMT

Thank you for your answer but I must use portal captive with Checkpoint R77.30 and when I authenticate on portal I have to see the ip address (the one with which I initiate authentication) on ISE cisco Radius live logs.

So, Could you tell me how to forward this ip source with R77.30 checkpoint version please?

Re: To send Radius AAA request To ISE Cisco

PhoneBoy — Mon, 17 Dec 2018 14:07:51 GMT

I'll double check, but I'm pretty sure, as I already stated, it's not possible.

Re: To send Radius AAA request To ISE Cisco

Royi_Priov — Mon, 17 Dec 2018 14:16:06 GMT

hi Franck-Elie Chiche‌,

I'm not sure I understand the background story here.

the captive portal you are referring to is Check Point captive portal?

If I remember correctly, for Cisco ISE there are two integration options with IDA: RADIUS accounting and Identity Collector.

Thanks,

Royi Priov

Identity Awareness R&D.

Re: To send Radius AAA request To ISE Cisco

Franck-Elie_Chi — Mon, 17 Dec 2018 14:47:27 GMT

The captive portal is CheckPoint captive portal: that's it!

But I want to have the IP address of the laptop which is authenticated in this portal in my ISE cisco logs.

I took a wirehark with fw monitor in CheckPoint and I never see my ip address, I just see NAS IP (checpoint address)

Re: To send Radius AAA request To ISE Cisco

Royi_Priov — Tue, 18 Dec 2018 07:50:10 GMT

The IP which is saved in the PDP database from the captive portal is the IP that the gateway see.

Why not sending RADIUS accounting messages from the ISE to CheckPoint GW, or even better, connecting the ISE to Identity Collector? you will be able to get both user, IP, machine, and even Cisco security tags.

This will also allow SSO login without user interaction.

Thanks,

Royi Priov

Identity Awareness R&D.

Re: To send Radius AAA request To ISE Cisco

Franck-Elie_Chi — Tue, 18 Dec 2018 07:55:54 GMT

No because It's my CheckPoint which authenticates the user and he must send the ip desktop to the ISE.

Re: To send Radius AAA request To ISE Cisco

PhoneBoy — Tue, 18 Dec 2018 13:13:34 GMT

As I said earlier on this thread, it's not something we do right now.

Such functionality would have to be added to the product in a later release.