Re: Identity Collector Not Collecting dot1x sessio...

sukruozdemir · ‎2022-08-18

Hello
We are using 802.1x on our wireless network. We do the verification via Cisco ISE. I collect usernames from Cisco ISE 2.4 with Identity Collector software and send them to Checkpoint. Thus, I can easily record which IP address is used by which user. We will soon start implementing 802.1x on the wired line. I have made my adjustments and I can use it by verifying. I see my own session in sessions on Cisco ISE, but Checkpoint Identity Collector does not collect it from Cisco ISE. So I can't map the wired IP address to the username.

Sorin_Gogean · ‎2022-08-19

hello,

not sure what guide you followed for ISE pxGrid and CheckPoint Identity Collector set-up, but from ISE you should use SGTs for your interesting traffic and in CheckPoint you create Identities based on those SGT's.

In our implementation, we can clearly identify the machines that ISE authenticate and pass the data further to CheckPoint through IC, but the user is still not identified properly - aka mapped in AD properly....

also the SGT's are properly mapped on the appropriate Identity Groups.

ty,

PS: i think we could get users properly identified, if we would address AD LDAP Global Catalog and not the standard one....

PS2: we do ISE dot1.x on copper (on almost whole network by the end of the year) and wifi (already done)

PhoneBoy · ‎2022-08-20

Getting the usernames is one thing, matching it to information in AD is another, and is the critical piece of making this work.

sukruozdemir · ‎2022-08-20

On the wireless line, users are drawn with identity collector. I see the login processes of those connected to the wireless line on the check point. Although the information of those who verify on the wired line is on Cisco, the identity collector does not receive them. In fact, they both have the same scenario, but I don't understand why they pull the sessions on the wireless and not on the wired.

Sorin_Gogean · ‎2022-08-23

still you did not say how you "collect usernames from Cisco ISE 2.4 with Identity Collector software and send them to Checkpoint."..... are you using pxGrid, or are you using RADIUS Accounting ?

if you state that you have everything OK from WiFi 802.1x , then replicate that on the cable and you're good to go.

without details we can't suppose stuff or see it in a crystal globe.

ty,

PS: waiting for details and maybe we can guide you properly 😊

sukruozdemir · ‎2022-08-28

Hello
Cisco ISE does not support Radius Accounting. With the pXGrid service of the Identity Collector, I am getting the validation records over Cisco ISE. Gateways are also connected to the Identity Collector, so the Collector sends them to Checkpoint.

Sorin_Gogean · ‎2022-08-29

hello @sukruozdemir ,

so ISE doesn't send anything to Identity Collector, the IC collects machine and user authentication from ISE via pxGrid.

therefore I don't see why you state that you don't get anything for cable authentications ....

do you have in your IC settings some filtering ? otherwise all authentications (wifi or cable) would be visible in IC via pxGrid.

can you give an example of an authentication that you see it in ISE/IC&GW and one that you don't . (as the ISE details you offered doesn't show anything wrong)

ty,

PS: for the Radius part, I was saying that you can point the network equipment to IC and that would collect the radius accounting data (still I need to look over documents here, but roughly it's like that)

I restored the IC and ISE integration. I regenerated all certificates. After activating the Accounting feature on the switch, session information began to appear on the IC. But this time it does not send it to Checkpoint. The IP and Username of the wireless connections are matched in Checkpoint, but the wired one is not.
I don't use filters.

Are you a member of CheckMates?

Identity Collector Not Collecting dot1x sessions from Cisco ISE