PaloAlto User-ID from Cisco ISE Nodes

I apologize this looks like ass. i pasted in from word. Remind me to never do that again. I couldn't find this info anywhere. I'll clean it up someday.

Adding ISE as a Syslog Provider to Palo Alto for User-ID

Info to gather

• PaloAltos

  • IP Address and interface on each FW you want to receive Syslogs
    

• ·         ISE

o   Understand your ISE deployment (single unit, distributed, etc)

o   IP address of the Policy Service Nodes from which the Syslogs will originate. Here forward ISE Policy Services Nodes maybe be called ISE PSN's or PSN. 

• ·         Network/Firewall

o   Ensure the ISE nodes can send udp 514 traffic from the IP address above to the PaloAlto IP addresses above.

In order to receive User to IP mappings for ISE you will need to do these basic steps.

•         Create the Palo Altos as syslog receivers within ISE. 
•          Configure ISE to send only RADIUS Accounting logs to the PAs that will be the log receivers.
• The accounting logs have the username and IP (Framed-IP-Address) of the user.
  Create a syslog filter on the PaloAltos to filter the appropriate information. Key field info (and yes, the “,/s” matters, it signifies a space is to follow. The “=” is required too):

o   Type: Field Identifier

o   Event String:  NOTICE Radius-Accounting: RADIUS Accounting

o   Username Prefix:  User-Name=

o   Username Delimiter: ,/s

o   Address Prefix:  Framed-IP-Address=

o   Address Delimiter: ,/s

·         Configure each Policy Service Node within ISE as a Server Monitor using the syslog filter just created. The IP address will be the ISE PSN IP address. Again, each PSN will need to be added, if applicable.

o   If ISE is distributed, you do NOT need your admin nor monitor nodes added

o   If it is a standalone, add the single ISE node as a Server Monitor

·         Ensure that the receiving interface on the PaloAltos allow User-ID Syslog UDP.

o   Option 1 – Interface Management Profile

o   Option 2 – Management profile (DO NOT LOCK YOURSELF OUT!)

·         Ensure the zone with users to be identified have USER-ID enabled. Use IP restrictions to limit.

·         Use the Include/Excluded Networks on Device à User Identification to include/limit also.

·         Verify via command-line/SSH.

o   show user ip-user-mapping all | match SYSLOG

o   show user server-monitor state all

Configure ISE

Configure PaloAlto Firewalls as a Syslog Receiver

Log into to ISE.

Under the Administration Menu, Select Logging.

Under Logging, Select Remote Logging Targets

Click Add. Enter in the appropriate information. The IP address should be your intended receiving interface on your PaloAlto. Most Logging is sent over UDP port 514. Submit when complete.

If you have redundant devices and you are logging to different IPs, create a second entry.

Set ISE to send Accounting to your targets.

Stay in the Logging Menu and Select Logging Categories

Select Radius Accounting under the Category (not Accounting as is highlighted).

Move your newly created target(s) to the Selected: side and save.

 

Configure the PaloAlto Firewalls

These instructions are in Panorama, but will work if follow along directly on the firewalls.

Configure the Syslog Filter to pull extract the User-ID information

Select Device à User Identification à User Mapping à Green Gear for Panorama; The plain gear will work for the firewalls directly.

Select Syslog Filters Tab, Click Add

Fill out the Syslog Parse Profile. You can use any Profile Name and Description you want.

You can use any Profile Name and Description you want.

The rest should be filled as above. PLEASE NOTE THE CHANGE IN EVENT STRING! Values are listed below.

·         Type: Field Identifier

·         Event String:  NOTICE Radius-Accounting: RADIUS Accounting

·         Username Prefix:  User-Name=

·         Username Delimiter: ,/s

·         Address Prefix:  Framed-IP-Address=

·         Address Delimiter: ,/s

The “,/s” looks for a comma and a blank space. Here is a capture of a RADIUS syslog from which the info was gathered.

Click Ok to have the filter.

Click Ok to exist the User-ID Agent Setup.

--UPDATE--
I modified the Event String. ISE sends 3 major types of 300x series accounting logs. 3000 and 3001 are accounting start and watchdog updates. These two types of updates contain User-ID to IP address mapping information. 3002 are stops. They all lead with "NOTICE Radius-Accounting: RADIUS Accounting". Using the more generic log filter allows all of these to be parsed. My original setup missed the watchdogs so many of my user mappings were timing out. Thus, I was losing mappings. This helped greatly. 

Configure the Server Monitoring Information with the new Syslog Filter

We will need to add every Policy Service Node that does authentication for the WLAN. You do NOT add your administration nor monitoring nodes, only the Policy Service Nodes (PSNs). If it is an all in one system, add the single ISE node. The syslogs are sent from the PSNs only.

Stay in Device à User Identification à User Mapping, Select Add under Server Monitoring

Fill out the User Identification Monitored server for EACH ISE PSN node.

Make sure to select the type as Syslog Sender. The Network Address will the ISE PSN IP address. The filter will be the newly created filter in the previous steps. The Default Domain Name will be your organization’s domain name.

At this point, you can follow all the standard rules for using a syslog server as a User ID source.

Remaining general steps:

1.  Fill-out included/excluded networks on the Device à User Identification tab.
2. Ensure the interface you are sending syslogs for User-ID has User-ID Syslog enabled.
1. Step 2 -- Option 1 --- Logging to a Network interface
1. Create an Interface Management Profile under the Network à Network Profiles à Interface Mgmt
2. Ensure User-ID Syslog Listener-UDP is enabled. Ensure the IP address of your PSN’s are permitted on the Permitted IP addresses tab.
3. On Network à Interfaces, select the interface with the IP address the syslog senders are sending too, and enable the management profile under the advanced tab

S

Step 2 -- Option 2 – Sending Syslogs to your PA’s management interface

WARNINGS:  BE CAREFUL NOT TO LOCK YOURSELF OUT! CHANGING SETTINGS HERE CAN LOCK YOU OUT OF MANAGEMENT ACCESS TO YOUR PALOALTOS!!! I’M NOT RESPONSIBLE IF YOU LOCK YOURSELF OUT.

If you manage over https, and ssh, make sure they boxes stay selected

If you use SNMP, leave it selected

If you do not have any Permitted IP Address, DO NOT add anything. All traffic is currently permitted. You might want to change that sometime, but that's a different topic.

a)      Select the Device Tab à Setup à Management à Management Interface Settings

b)      Ensure User-ID Syslog Listener-UDP is selected.

c)       Add the Permitted IP addresses of your ISE nodes (WARNING: Only if you have management interface IP restrictions! – be careful not to lock yourself out. If you do not have restrictions, all traffic is permitted, so DO NOT add anything!!! Please make sure you have your management workstation/network already added before adding these entries.)

3)      Enable User-ID on the appropriate zones.

Network à Zones

Click on the appropriate zones. Add the networks to the User Identification ACL

Passed -- Cisco 300-115 -- Switch

Another down! Yay! Thoughts and comments time

The Test:

• I used 87 of the allotted 90 minutes to complete 44 questions with a mid 900 score. Remember, there is no going back so you have to answer the question then and there when it is presented. Waiting for an moment of clarity later in the exam isn't an option. You gotta grind it out right then when the questions/scenario comes up.
• Two or three of the questions had 4-6 parts on configuration review, analysis, troubleshooting and remediation options/recommendations. These chewed a significant chunk of time. Most of it was spent reading the questions to figure out what they are really asking plus reviewing the configs. These are the ones where you truly want more screen space. It felt like most of the time was spent using show commands and having to maneuver windows so I could see the relevant information between two or three devices. I'm sure dual monitors would have saved me about 5-10 minutes here.
•  There were three configuration items. The configuration tasks were somewhat long. 
• The steps had to be completed in a specific order compared to what is permitted in real life. I'm sure most people would do the steps in the order I chose. For example, configuring AAA, I always configure my authentication sources first, then do the actual AAA methods. However, on the test, AAA methods had to be done first, THEN the authentication source commands worked. That took 5+ minutes of going, "WTF, is there another way of configuring RADIUS/TACACS servers I don't know and didn't practice?" So I launched into the AAA methods and all of a sudden I could do my AAA servers after that. Basically if the command you -know- works doesn't work right away, try another portion of the question. The failing command may all of a sudden work later. 
• The configuration tasks had LOTS of requirements on a couple of them. Some of the validation for the early items relied upon the completion of the later items. I probably could have read the full question two or three times to figure out what order to do the steps, but I didn't.
• As you type your commands and change interface status you may get messages (even if you administratively shutdown the interfaces). Int up, protocol up. 2 seconds later, Int down, protocol down. Pretend its the TV, and don't believe everything you see. Check your interfaces with your commands. Check the changes you made with the other show commands (trunk, channels, monitor, dot1x, whatever).
• There were a handful of review the exhibit, here's a problem, what's the most like cause or what is the best remediation option.
• The rest were standard multiple choice fare including edge cases, do you know the protocols well, do you know the difference between protocols, etc.
• I thought there were two questions with no right answers. Example, what happens to a standby track priority when the track interface goes down and comes back up. Essentially, nothing in my book. Yes, it decrements, but then it returns to normal value. The question asked about the end state value. No delta or up and return weren't on the list.

Study Material:

• I used CBTNuggets video series from both Jeremy and Keith along with the Safaribooks version of the 300-115 Study Guide from Cisco Press.
• Jeremy's was a good introduction to most the topics. There wasn't always a lot of meat in the material in regards to answering the last bullet above.
• Keith and Jeremy's labs were very good. Again, I got to the point I could do the labs on my equipment (or least type the commands in the right order and location) by just looking at the topic that was going to be covered. One of the important points in these labs if to listen if either of them say something that would make you think, EDGE-case question! I went through Keith's twice and a couple of Jeremy's twice to catch these. The second time through on the labs, I paused the video after the setup and goals were established and tried to complete the task without watching the video. Good practice for the exam simulators.
• The SafariBooks piece had all the extreme information, what the min, what is the max, what are the timers, what are the defaults, what are the ports/protocols, etc. Safari also covered RPR, RPR+, SSO, and NSF.
• Practice tests were those provided by CBTNuggets via Transcender and SelfTest. The content in these bordered on useless. It seemed like 40% of the material was old and dated and not on the test (wireless, voice, cef, etc). In addition the explanations were wrong. (vtp version 2, not vtp-mode v2 like the explanation given). These were used mostly to get used to deciphering the test questions.

Study Environment

• Pure GNS3, v1.3. I used the IOU L2 images along with c7200 routers when I could. These did most of the commands. Short-comings on the images I used
• SPAN/RSPAN doesn't work at all. Just typed the commands to practice.
• Private VLAN doesn't "work". The commands are permitted and required in the correct order. However, the configuration isn't supported so no functional changes are done but the commands are there. The show commands pretty much work, but tell you, yep, it doesn't work.
• 802.1x not fully implemented on interfaces
• radius-server host didn't exist
• lldp doesn't exist
• vlan acls do not work
• sdm is not there
• ip dhcp snooping doesn't work right. commands are available, but turning it on with trusted ports causes DHCP to break. DAI is not there at all.
• int vlan x; ip add x.x.x.x; t didn't always work between the IOU devices, especially with FHRP protocols. EIGRP/OSPF would neighbor great, but the FHRP simply wouldn't see each other. I had to use the 7200 routers to do FHRP practice.
• RPR, RPR+, SSO don't work (duh)
• Stackwise isn't there (duh)
• None of these were a deal-breaker. If the command wasn't supported, I just watched the video, typed the command at the right location, review the video results, moved on. Its all about repetition to memorize the commands.
• Another thought on the GNS3 for practice was seeing the odd messages that shouldn't appear with a admin down interface made the strangeness on the exam simulator not so shocking.

Overall, the test was pretty much what I expected. I think only one question surprised me in terms of content. The testing objectives lined up well and the official study material did well to cover the objectives. It didn't hurt having 15 years of managing 2000+ campus switches so a lot of it was old hat.

Anyhow, onto TSHOOT. Good luck.

Passed -- Cisco Route 300-101

I took the Cisco Route 300-101 exam today and some how managed to pass it. It was a long test for me as it took 87 of the 90 minutes allotted. This was due primarily to the simulations. I had trouble getting one working although I thought I had it configured correctly. I re-lab'd it up at home and it the solution worked as I expected it. Strange. Anyhow, a quick review.

I used the CBT Nuggets material and the Cisco authorized book via Safari Books Online. This pair seemed to work well. CBT provided the practice labs, the overview of most of the technologies covered, and the practice test from SelfTest and Transcenders. The book filled in the gaps when taking the practice tests. There were definitely questions in the practice tests that weren't in the Nuggets info. Having said all that, the items played well together and gave me enough information to pass.

The test was relatively short (under 60 questions), but 4-6 were simulations. Remember, this is a Cisco test so there is no going back so these have to be done when presented. I ran into some difficultly on a couple of them due to ... imprecise information. Some of the simulation questions required very precise subnet information, while others wanted me to grab the entire classful network. However, it wasn't clear until testing my solutions what they were looking for. Looking into the routing statements, interfaces, etc to help, simply didn't help. So I had to configure ACLs etc, multiple times, test each version, and clear out the wrong information. This drained my time very quickly on two questions as they took 15 minutes each. I had to leave one wrong (according the simulator, but not gns3 at home) and move on. I was 13 questions from finished with 15 minutes to go. Yikes. Luckily the last simulation was relatively easy for me and I finished at 2:45 left to go.

Anyhow, I like the idea of simulations and practical experience, but the engine needs some work still. Some commands aren't always available, but then you are given access to "show run" in the same question. Sometimes sifting through the run when a single concise show is faster. Next, there needs to be more screen space for the sims. Trying to view 4 routers consoles, the scenario question, and a diagram on a single monitor is a chore. I spent a lot of time flipping between those items while completing the simulations.

Last, I didn't like the fact that one topic was not covered at all in the test from the layer 3 techs area that required a significant effort while another single topic in infrastructure was hammered on 4 times. Maybe it was just luck of the draw.

Anyhow, onto switch while we hunt.