Aruba Clear Pass Integration - API

[Jason_Carrillo]

We are trying to leverage the R80.10 web API to integrate our Check Point gateways with Aruba Clear Pass. We are having a heckuva time getting it to work reliably, which is kind of maddening because you would think a POST from a server to the gateway would be the most efficient and reliable way to achieve this over AD Query and RADIUS Accounting. 

What we are seeing is the Aruba server failing to send the POST messages to the gateways in a reliable manner. We've turned off IPv6, we've turned off machine authentication, and it still doesn't work right. It will work sometimes, then other times just fail altogether. 

If you have had luck with this integration and wouldn't mind sharing some tips, places to look, or troubleshooting steps, it would be much appreciated. We have tickets open with Aruba TAC and their engineering team, but they seem as confused as we are. 

Thanks!

[Andrew_Neve]

Have a look at sk104958 in Checkpoint Partner Map and the link within it to the 3rd party Aruba document

ClearPass 6.5

Tech Note: ClearPass

Integration with 3rd Party Enforcement Points

ClearPass & Checkpoint utilizing RESTful

API and RADIUS Accounting

[Jason_Carrillo]

Thanks Andrew. We've reviewed that document thoroughly, it was helpful getting it set up initially, but there are other issues we are seeing since implementation.

It doesn't help that it is a few years old and there aren't current documents for R80.10.

Sent from my MetroPCS 4G LTE Android device

[Jason_Carrillo]

We've actually heard back from Aruba on this, and the process that sends the API POST message from Clear Pass to the firewall is unreliable, and we aren't the first customer to have issues with it. They are working on a fix for this at the "highest levels of engineering". 

In the interim we've moved to using the RADIUS accounting feature and passing roles to the firewall using the "Connect-Info" attribute. So far so good, but there are some challenges if you want the Clear Pass side to send roles via RADIUS accounting.  Identity Awareness R80.10 Administration Guide 

Now I just have to find a way to add a bunch of user groups to the firewall because it seems like when Check Point designed the API they didn't put in a hook for that kind of group creation. 

I'll update this when I hear back from Aruba about a fix. 

[Marc_Guyard]

Hi Jason,

i working on a PoC with ClearPass and API integration work.

but native api path include in clearpass are false. You need to change url in clearpass configuration.

for example, to add identity in Check Point, ClearPass need to use this URL : https://<Gateway_IP_or_FQDN>/_IA_API/v1.0/add-identity

it’s not the case by default.

all urls are in IA R80.10 Admi Guide

[Jason_Carrillo]

I have an update to this. We are still using the RADIUS Accounting feature and have a new fun issue with this feature. We are getting users who log in to wireless, all the information is forwarded to the firewall as expected. Then, for some reason, the Clear Pass server will send another RADIUS Accounting message with no information, which overwrites the old entry for that user and removes their rights/roles/groups. Neat! Another ticket for Aruba...

[Pedro_Fernandes]

Hello,
Does anyone find an updated documentation with R80.10 or R80.20 for the Aruba Clearpass integration?

I'm looking for a way to create a network access rule using the operating system or host type records that I can find in the event logs. Is this anyway possible?

[Danny_Jump]

The new Integration Guide will be posted by early next week on the Aruba Support site.

[Jason_Carrillo]

At this point, if you don't have to attempt to integrate with the Aruba Clear Pass system, you should probably avoid it. We attempted to use the API early on and had all kinds of issues that Aruba couldn't explain. They went back to the drawing board, and we settled Radius Accounting, after building out a bunch of backend, Active Directory group stuff, with the promise that the API would be fixed and updated.

Radius Accounting was great, up until you need Clear Pass to send updates to the firewall in a timely manner. We see 5 to 20 minute delays between user log in and the messages being sent by the Aruba side.

Months waiting, new code provided, still seeing same weirdness with the API, and an inability to explain why Clear Pass is doing what it is doing. 

In my opinion, Clear Pass integration via API or Radius Accounting on a large network is half-baked at best. Because the integration piece is just so broken right now, we are going to have to crack open our firewall rules and do enforcement on the Aruba side...So goodbye to my easy to understand, troubleshoot and log Check Point rules I think.

[PhoneBoy]

Is it because of issues with Aruba, Check Point issues, or both?

[Jason_Carrillo]

The issue is with Aruba because it comes down to two things: either a delay in notification sent to the firewall with Radius Accounting or with API there is an issue with extraneous logout events being sent to the Rest API caused by the machine authentication.

One thing that Check Point could do to save Aruba from itself is to provide a User field in the delete-identity API call. Basically we see the Aruba side sending simultaneous add-identity calls for the user name along with delete-identity calls for the machine "user" name. This is causing our entry in the firewall to show a log in and then an immediate log out because the delete-identity call is only based on IP address.

[PhoneBoy]

That sounds like a potential RFE.

Royi Priov‌

[Jason_Carrillo]

True, but then again Aruba should be able to distinguish a Domain computer user account login from a human user account login and not stomp all over the necessary API calls...

[Royi_Priov]

Hi Jason Carrillo‌,

First, I'm sorry to hear that the Aruba integration is not working as expected. I can understand that the issues are falling on Aruba side, but in case Identity Awareness R&D should be involved you are welcome to update me.

Second, as for the delete messages, we are not requesting for the username by default and indeed adding this is possible with RFE.

Thanks,

Royi.

[Benjamin_Lamber]

Hi Jason,

I'm very glad I found this thread as it may have saved me a ton of time!

What version of ClearPass are you running? I'm curious if they've updated any of it as I'm still running 6.6.x with plans to update to 6.7.

Thanks,

--Ben

[Jason_Carrillo]

6.7.8 currently, but we've had this problem since the pilot. Not sure of the version at that time, may have been 6.5.x

[Jason_Carrillo]

We've been working closely with Aruba TAC on this and they've made a fix that is functional. It is a code modification that is going to end up in the next patch.

Clear Pass is still sending logouts when it shouldn't and not sending log outs when it should, but because they 'fixed' the sequence of events the test users seem be having improved performance. We are considering abandoning the logouts entirely in lieu of Check Point enforcing one user per IP. It's not what we were sold but it will work.

We have started playing around with the Identity Collector, and I have to say, I am impressed so far. We have one IDC hitting 16 AD controllers pushing to one firewall now. It consistently beats Aruba Clear Pass authentication notifications by 20-40 seconds.

[Royi_Priov]

Hi Jason Carrillo,

I want to get more details about this issue. I was asked by Aruba R&D as well.

Can you give me Aruba / CheckPoint ticket number?

Jason Carrillo wrote:

We've been working closely with Aruba TAC on this and they've made a fix that is functional. It is a code modification that is going to end up in the next patch.

Clear Pass is still sending logouts when it shouldn't and not sending log outs when it should, but because they 'fixed' the sequence of events the test users seem be having improved performance. We are considering abandoning the logouts entirely in lieu of Check Point enforcing one user per IP. It's not what we were sold but it will work.

We have started playing around with the Identity Collector, and I have to say, I am impressed so far. We have one IDC hitting 16 AD controllers pushing to one firewall now. It consistently beats Aruba Clear Pass authentication notifications by 20-40 seconds.

[Jason_Carrillo]

5335604614  API Troubleshooting
5328368971 Delayed RADIUS Accounting messages

[Royi_Priov]

Jason Carrillo wrote:

5335604614  API Troubleshooting
5328368971 Delayed RADIUS Accounting messages

Thanks.

I'm checking it offline with Aruba R&D.

Royi Priov.

[Prachachart_Sta]

Hi Jason,

        As the code modification that makes your impress. Can I ask you that you still working integration with Clearpass by RADIUS Accounting or RESTful API for now? 

       Thanks.

Prachachart.S

[Jason_Carrillo]

The code from Aruba doesn't impress me. Based on the PDP debug on the Check Point side, it is still sending log outs when it shouldn't, and doesn't reliably send log outs when the user log outs. I am impressed with the Check Point Identity Collector. Even after a few weeks it is still beating Aruba to the punch.

We are still having problems with RADIUS Accounting and have a ticket open.

Right now we are considering turning off logouts completely since we can't rely on Aruba to send those when it should.

[Kevin_Zeitler]

Jason,

Have you made it any further with Aruba?  I am seeing the same issue with Aruba sending back a logout immediately after machine authentication takes place.  You mentioned disabling logouts where do you see that option?

[Jason_Carrillo]

Hey Kevin, sorry for the delayed response.

We are currently using the latest code for Clear Pass and the API piece is working as expected and consistently. We are still using logouts as part of our solution, but we are still considering turning it off as it is causing some issues with folks using Docker VMs.

[Jason_Carrillo]

Currently running Clear Pass Policy Manager 6.7.9.109195 we are having success with the API post authentication module. The updates Aruba made have gotten us to where we need to be and are setting up our wireless clients up to use the API post authentication module. Radius Accounting still struggles though to consistently send authentication to the firewall, but we don't need it because the API is working well.

We still only have about 400 users whose auths are reported to the firewall via API, but we are working to get its usage expanded.

[Piotr_Czura]

Hi, can you please share your JSON code which is sent to CHP? We have a problem with the variables in the code. It works fine on the hard-set address and username, but after setting these values as variables, we get an error message when sending a state change