cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

To send Radius AAA request To ISE Cisco

Hello,

my problem is as follow:

I created an Identity Awarness on CheckPoint R77.30, It works well.

But when I'm authenticated, I can see my logs on an ISE Cisco and in my log I see my username who is authenticated with token in my my captive portal but I never see my IP ADDRESS...

Please I need to see my ip address so could you help me? 

Maybe I forgot something in CheckPoint configuration...

10 Replies
Admin
Admin

Re: To send Radius AAA request To ISE Cisco

What specific log are you expecting to find the IP in?

It should definitely show in the Check Point logs…

0 Kudos

Re: To send Radius AAA request To ISE Cisco

Yes but I need to get it on My ISE cisco radius livelogs but I just get the nas ip address (checkpoint ip).

0 Kudos
Admin
Admin

Re: To send Radius AAA request To ISE Cisco

The whole point of the Cisco ISE integration is to utilize the information Cisco ISE provides automatically.

More specifically, you shouldn't have to use Captive Portal.

When we have to authenticate the user using Captive Portal, we don't pass the client IP address to the remote server.

The correct steps to integrate are described in the Identity Awareness documentation

0 Kudos

Re: To send Radius AAA request To ISE Cisco

Thank you for your answer but I must use portal captive with Checkpoint R77.30 and when I authenticate on portal I have to see the ip address (the one with which I initiate authentication) on ISE cisco Radius live logs.

So, Could you tell me how to forward this ip source with R77.30 checkpoint version please?

0 Kudos
Admin
Admin

Re: To send Radius AAA request To ISE Cisco

I'll double check, but I'm pretty sure, as I already stated, it's not possible.

0 Kudos
Employee+
Employee+

Re: To send Radius AAA request To ISE Cisco

hi Franck-Elie Chiche‌,

I'm not sure I understand the background story here.

the captive portal you are referring to is Check Point captive portal?

If I remember correctly, for Cisco ISE there are two integration options with IDA: RADIUS accounting and Identity Collector.

Thanks,

Royi Priov

Identity Awareness R&D.

Re: To send Radius AAA request To ISE Cisco

The captive portal is CheckPoint captive portal: that's it!

But I want to have the IP address of the laptop which is authenticated in this portal in my ISE  cisco logs.

I took a wirehark with fw monitor in CheckPoint and I never see my ip address, I just see NAS IP (checpoint address)

0 Kudos
Employee+
Employee+

Re: To send Radius AAA request To ISE Cisco

The IP which is saved in the PDP database from the captive portal is the IP that the gateway see.

Why not sending RADIUS accounting messages from the ISE to CheckPoint GW, or even better, connecting the ISE to Identity Collector? you will be able to get both user, IP, machine, and even Cisco security tags.

This will also allow SSO login without user interaction.

Thanks,

Royi Priov

Identity Awareness R&D.

0 Kudos

Re: To send Radius AAA request To ISE Cisco

No because It's my CheckPoint which authenticates the user and he must send the ip desktop to the ISE.

0 Kudos
Admin
Admin

Re: To send Radius AAA request To ISE Cisco

As I said earlier on this thread, it's not something we do right now.

Such functionality would have to be added to the product in a later release.

0 Kudos