Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Franck-Elie_Chi
Participant

To send Radius AAA request To ISE Cisco

Hello,

my problem is as follow:

I created an Identity Awarness on CheckPoint R77.30, It works well.

But when I'm authenticated, I can see my logs on an ISE Cisco and in my log I see my username who is authenticated with token in my my captive portal but I never see my IP ADDRESS...

Please I need to see my ip address so could you help me? 

Maybe I forgot something in CheckPoint configuration...

10 Replies
PhoneBoy
Admin
Admin

What specific log are you expecting to find the IP in?

It should definitely show in the Check Point logs…

0 Kudos
Franck-Elie_Chi
Participant

Yes but I need to get it on My ISE cisco radius livelogs but I just get the nas ip address (checkpoint ip).

0 Kudos
PhoneBoy
Admin
Admin

The whole point of the Cisco ISE integration is to utilize the information Cisco ISE provides automatically.

More specifically, you shouldn't have to use Captive Portal.

When we have to authenticate the user using Captive Portal, we don't pass the client IP address to the remote server.

The correct steps to integrate are described in the Identity Awareness documentation

0 Kudos
Franck-Elie_Chi
Participant

Thank you for your answer but I must use portal captive with Checkpoint R77.30 and when I authenticate on portal I have to see the ip address (the one with which I initiate authentication) on ISE cisco Radius live logs.

So, Could you tell me how to forward this ip source with R77.30 checkpoint version please?

0 Kudos
PhoneBoy
Admin
Admin

I'll double check, but I'm pretty sure, as I already stated, it's not possible.

0 Kudos
Royi_Priov
Employee
Employee

hi Franck-Elie Chiche‌,

I'm not sure I understand the background story here.

the captive portal you are referring to is Check Point captive portal?

If I remember correctly, for Cisco ISE there are two integration options with IDA: RADIUS accounting and Identity Collector.

Thanks,

Royi Priov

Identity Awareness R&D.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D
Franck-Elie_Chi
Participant

The captive portal is CheckPoint captive portal: that's it!

But I want to have the IP address of the laptop which is authenticated in this portal in my ISE  cisco logs.

I took a wirehark with fw monitor in CheckPoint and I never see my ip address, I just see NAS IP (checpoint address)

0 Kudos
Royi_Priov
Employee
Employee

The IP which is saved in the PDP database from the captive portal is the IP that the gateway see.

Why not sending RADIUS accounting messages from the ISE to CheckPoint GW, or even better, connecting the ISE to Identity Collector? you will be able to get both user, IP, machine, and even Cisco security tags.

This will also allow SSO login without user interaction.

Thanks,

Royi Priov

Identity Awareness R&D.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D
0 Kudos
Franck-Elie_Chi
Participant

No because It's my CheckPoint which authenticates the user and he must send the ip desktop to the ISE.

0 Kudos
PhoneBoy
Admin
Admin

As I said earlier on this thread, it's not something we do right now.

Such functionality would have to be added to the product in a later release.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events