Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
CP-NDA
Collaborator

R80.20 Identity Awareness API

Hi,

I'm trying to implement IA API & clearpass however API URL is not responding and pdp API status returns Invalid colmand

Do we need to enable something on the gateway on top of SmartConsole config (IA source)?

Thank you

0 Kudos
6 Replies
KennyManrique
Advisor

Hi Nicolas,

Did you enable Identity Web API and allowed the specific hosts under Gateway's IA configuration??

Regards.

0 Kudos
CP-NDA
Collaborator

Yes it's enabled in SmartConsole

0 Kudos
PhoneBoy
Admin
Admin

Did you set the allowed interfaces?

For my first try, I forgot to do that.

Here's what I saw when I queried the API endpoint directly using curl from a Linux machine:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"

<!DOCTYPE html><HTML><HEAD>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9,EmulateIE8"><meta name="others" content="WEBUI LOGIN PAGE"  /><TITLE>Gaia</TITLE>

<link rel="shortcut icon" href="https://community.checkpoint.com/login/fav.ico">

<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/ext-all.css" />

<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/login.css" />

<STYLE TYPE="text/css">

.ext-ie .webui-login-fld{font-size: 11px;}

</STYLE>

<script type="text/javascript" src="/login/ext-base.js"></script><script type="text/javascript" src="/login/ext-all.js"></script><script type="text/javascript">var errMsgText = "";var bannerMsgText = "";bannerMsgText += "This system is for authorized use only.";var hostname='';var version='R80.20';var formAction="/cgi-bin/home.tcl";</script><script type="text/javascript" src="/login/login.js"></script></HEAD><BODY><noscript><div style='font-size:20px;position:relative;top:100px;'>For full functionality of this site it is necessary to enable JavaScript.</div></noscript></BODY></HTML>

This tells me MultiPortal believes the connection should go to the Gaia portal, which is the default.

After setting the allowed interfaces for the IDA API as shown above, I got a different message when querying the API:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML>

<HEAD>

<TITLE> 404 File Not Found </TITLE>

</HEAD>

<BODY>

The URL you requested could not be found on this server.

</BODY>

</HTML>

When I actually pass the correct information via the API call, I get a meaningful result:

curl --silent --insecure -XPOST https://10.6.5.1/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{ \"shared-secret\": \"aaaa\", \"ip-address\": \"1.1.1.1\" }"

{

   "ipv4-address" : "1.1.1.1",

   "message" : "total 0 user records were found."

}

0 Kudos
CP-NDA
Collaborator

Hi Dameon,

Yes of course we did but we don't get any answer from API... We also tried to change setting On all interface to make sure but without success

I will try to reboot the gateway this weekend or open a TAC ticket

Thank you

0 Kudos
PhoneBoy
Admin
Admin

No answer at all?

Maybe the firewall access policy is blocking the traffic.

Any logs?

What does tcpdump/fw monitor show?

0 Kudos
Soeren_Rothe
Collaborator

In R81 your command didn't work for me. 

This worked for me:

curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaa",\n "ip-address":"192.168.1.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity

 

[root@lnx ~]# curl -k -H "Content-Type: application/json" -d $'{"shared-secret":"aaaaaaaa",\n "ip-address":"192.168.0.11"}' https://192.168.0.1/_IA_API/v1.0/show-identity
{
   "ipv4-address" : "192.168.0.11",
   "message" : "total 0 user records were found."
}
[root@lnx ~]# 

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events