To send Radius AAA request To ISE Cisco

[Franck-Elie_Chi]

Hello,

my problem is as follow:

I created an Identity Awarness on CheckPoint R77.30, It works well.

But when I'm authenticated, I can see my logs on an ISE Cisco and in my log I see my username who is authenticated with token in my my captive portal but I never see my IP ADDRESS...

Please I need to see my ip address so could you help me? 

Maybe I forgot something in CheckPoint configuration...

[PhoneBoy]

What specific log are you expecting to find the IP in?

It should definitely show in the Check Point logs…

[Franck-Elie_Chi]

Yes but I need to get it on My ISE cisco radius livelogs but I just get the nas ip address (checkpoint ip).

[PhoneBoy]

The whole point of the Cisco ISE integration is to utilize the information Cisco ISE provides automatically.

More specifically, you shouldn't have to use Captive Portal.

When we have to authenticate the user using Captive Portal, we don't pass the client IP address to the remote server.

The correct steps to integrate are described in the Identity Awareness documentation. 

[Franck-Elie_Chi]

Thank you for your answer but I must use portal captive with Checkpoint R77.30 and when I authenticate on portal I have to see the ip address (the one with which I initiate authentication) on ISE cisco Radius live logs.

So, Could you tell me how to forward this ip source with R77.30 checkpoint version please?

[PhoneBoy]

I'll double check, but I'm pretty sure, as I already stated, it's not possible.

[Royi_Priov]

hi Franck-Elie Chiche‌,

I'm not sure I understand the background story here.

the captive portal you are referring to is Check Point captive portal?

If I remember correctly, for Cisco ISE there are two integration options with IDA: RADIUS accounting and Identity Collector.

Thanks,

Royi Priov

Identity Awareness R&D.

[Franck-Elie_Chi]

The captive portal is CheckPoint captive portal: that's it!

But I want to have the IP address of the laptop which is authenticated in this portal in my ISE  cisco logs.

I took a wirehark with fw monitor in CheckPoint and I never see my ip address, I just see NAS IP (checpoint address)

[Royi_Priov]

The IP which is saved in the PDP database from the captive portal is the IP that the gateway see.

Why not sending RADIUS accounting messages from the ISE to CheckPoint GW, or even better, connecting the ISE to Identity Collector? you will be able to get both user, IP, machine, and even Cisco security tags.

This will also allow SSO login without user interaction.

Thanks,

Royi Priov

Identity Awareness R&D.

[Franck-Elie_Chi]

No because It's my CheckPoint which authenticates the user and he must send the ip desktop to the ISE.

[PhoneBoy]

As I said earlier on this thread, it's not something we do right now.

Such functionality would have to be added to the product in a later release.