PaloAlto User-ID from Cisco ISE Nodes

I apologize this looks like ass. i pasted in from word. Remind me to never do that again. I couldn't find this info anywhere. I'll clean it up someday.

Adding ISE as a Syslog Provider to Palo Alto for User-ID

Info to gather

• PaloAltos

  • IP Address and interface on each FW you want to receive Syslogs
    

• ·         ISE

o   Understand your ISE deployment (single unit, distributed, etc)

o   IP address of the Policy Service Nodes from which the Syslogs will originate. Here forward ISE Policy Services Nodes maybe be called ISE PSN's or PSN. 

• ·         Network/Firewall

o   Ensure the ISE nodes can send udp 514 traffic from the IP address above to the PaloAlto IP addresses above.

In order to receive User to IP mappings for ISE you will need to do these basic steps.

•         Create the Palo Altos as syslog receivers within ISE. 
•          Configure ISE to send only RADIUS Accounting logs to the PAs that will be the log receivers.
• The accounting logs have the username and IP (Framed-IP-Address) of the user.
  Create a syslog filter on the PaloAltos to filter the appropriate information. Key field info (and yes, the “,/s” matters, it signifies a space is to follow. The “=” is required too):

o   Type: Field Identifier

o   Event String:  NOTICE Radius-Accounting: RADIUS Accounting

o   Username Prefix:  User-Name=

o   Username Delimiter: ,/s

o   Address Prefix:  Framed-IP-Address=

o   Address Delimiter: ,/s

·         Configure each Policy Service Node within ISE as a Server Monitor using the syslog filter just created. The IP address will be the ISE PSN IP address. Again, each PSN will need to be added, if applicable.

o   If ISE is distributed, you do NOT need your admin nor monitor nodes added

o   If it is a standalone, add the single ISE node as a Server Monitor

·         Ensure that the receiving interface on the PaloAltos allow User-ID Syslog UDP.

o   Option 1 – Interface Management Profile

o   Option 2 – Management profile (DO NOT LOCK YOURSELF OUT!)

·         Ensure the zone with users to be identified have USER-ID enabled. Use IP restrictions to limit.

·         Use the Include/Excluded Networks on Device à User Identification to include/limit also.

·         Verify via command-line/SSH.

o   show user ip-user-mapping all | match SYSLOG

o   show user server-monitor state all

Configure ISE

Configure PaloAlto Firewalls as a Syslog Receiver

Log into to ISE.

Under the Administration Menu, Select Logging.

Under Logging, Select Remote Logging Targets

Click Add. Enter in the appropriate information. The IP address should be your intended receiving interface on your PaloAlto. Most Logging is sent over UDP port 514. Submit when complete.

If you have redundant devices and you are logging to different IPs, create a second entry.

Set ISE to send Accounting to your targets.

Stay in the Logging Menu and Select Logging Categories

Select Radius Accounting under the Category (not Accounting as is highlighted).

Move your newly created target(s) to the Selected: side and save.

 

Configure the PaloAlto Firewalls

These instructions are in Panorama, but will work if follow along directly on the firewalls.

Configure the Syslog Filter to pull extract the User-ID information

Select Device à User Identification à User Mapping à Green Gear for Panorama; The plain gear will work for the firewalls directly.

Select Syslog Filters Tab, Click Add

Fill out the Syslog Parse Profile. You can use any Profile Name and Description you want.

You can use any Profile Name and Description you want.

The rest should be filled as above. PLEASE NOTE THE CHANGE IN EVENT STRING! Values are listed below.

·         Type: Field Identifier

·         Event String:  NOTICE Radius-Accounting: RADIUS Accounting

·         Username Prefix:  User-Name=

·         Username Delimiter: ,/s

·         Address Prefix:  Framed-IP-Address=

·         Address Delimiter: ,/s

The “,/s” looks for a comma and a blank space. Here is a capture of a RADIUS syslog from which the info was gathered.

Click Ok to have the filter.

Click Ok to exist the User-ID Agent Setup.

--UPDATE--
I modified the Event String. ISE sends 3 major types of 300x series accounting logs. 3000 and 3001 are accounting start and watchdog updates. These two types of updates contain User-ID to IP address mapping information. 3002 are stops. They all lead with "NOTICE Radius-Accounting: RADIUS Accounting". Using the more generic log filter allows all of these to be parsed. My original setup missed the watchdogs so many of my user mappings were timing out. Thus, I was losing mappings. This helped greatly. 

Configure the Server Monitoring Information with the new Syslog Filter

We will need to add every Policy Service Node that does authentication for the WLAN. You do NOT add your administration nor monitoring nodes, only the Policy Service Nodes (PSNs). If it is an all in one system, add the single ISE node. The syslogs are sent from the PSNs only.

Stay in Device à User Identification à User Mapping, Select Add under Server Monitoring

Fill out the User Identification Monitored server for EACH ISE PSN node.

Make sure to select the type as Syslog Sender. The Network Address will the ISE PSN IP address. The filter will be the newly created filter in the previous steps. The Default Domain Name will be your organization’s domain name.

At this point, you can follow all the standard rules for using a syslog server as a User ID source.

Remaining general steps:

1.  Fill-out included/excluded networks on the Device à User Identification tab.
2. Ensure the interface you are sending syslogs for User-ID has User-ID Syslog enabled.
1. Step 2 -- Option 1 --- Logging to a Network interface
1. Create an Interface Management Profile under the Network à Network Profiles à Interface Mgmt
2. Ensure User-ID Syslog Listener-UDP is enabled. Ensure the IP address of your PSN’s are permitted on the Permitted IP addresses tab.
3. On Network à Interfaces, select the interface with the IP address the syslog senders are sending too, and enable the management profile under the advanced tab

S

Step 2 -- Option 2 – Sending Syslogs to your PA’s management interface

WARNINGS:  BE CAREFUL NOT TO LOCK YOURSELF OUT! CHANGING SETTINGS HERE CAN LOCK YOU OUT OF MANAGEMENT ACCESS TO YOUR PALOALTOS!!! I’M NOT RESPONSIBLE IF YOU LOCK YOURSELF OUT.

If you manage over https, and ssh, make sure they boxes stay selected

If you use SNMP, leave it selected

If you do not have any Permitted IP Address, DO NOT add anything. All traffic is currently permitted. You might want to change that sometime, but that's a different topic.

a)      Select the Device Tab à Setup à Management à Management Interface Settings

b)      Ensure User-ID Syslog Listener-UDP is selected.

c)       Add the Permitted IP addresses of your ISE nodes (WARNING: Only if you have management interface IP restrictions! – be careful not to lock yourself out. If you do not have restrictions, all traffic is permitted, so DO NOT add anything!!! Please make sure you have your management workstation/network already added before adding these entries.)

3)      Enable User-ID on the appropriate zones.

Network à Zones

Click on the appropriate zones. Add the networks to the User Identification ACL

Random status Update

Random status update:


I've taken a job where I went to college the first time before I dropped out. The world is such a small place. Good job, better people, very good work environment. Pay, meh. What are you going to do? I was burned out on management so just simply been task driven is nice instead of leading others. Funny, how much you learn as a manager, what you did well, what you sucked at, how others do better than or worse than you in each area. One thing from all of it I've learned, most people are social animals. Treat them as such. Not animals, but as social creatures. Talk, visit, etc. Even the quiet ones. Management by walking around, is hell of a method to this day. 1 hr of time = happy people. In addition, it gets the uninspired moving a bit more.

I've been assigned to straddle security and netops so I am learning (relearning?) some things. In particular, I'm taking on PaloAlto's firewalls. I'll take my ACE exam soon, then the PNCSE. Kinda makes me miss the cisco tests. More practice tests and simulators in the Cisco world.

Anyhow, I've determined that K-12 environments should adopt VRF's or similar functions instead of building based designs. Its not much of a change, but VRFs keeps the kids traffic with the kids, the staff with the staff, and the teachers with the teachers. From there, policy decisions become much easier and less worry of cross over traffic due to routing.

Passed -- Cisco 300-135 -- TSHOOT

Well that was a fun test.

Test Info:

• Total of 21 questions
• handful of multiple choice
• 2 mini scenarios
• 13-15 are the scenario based problems. These are based on the published topology from Cisco.

Test Studying Thoughts:

• First of I believe you need to master the scenario by practicing. You have 2 hours to knock this one out, and answer 20ish questions while trying to learn the network map is going to be a huge challenge. I used CBTNuggets course from Mr. Barker again. I didn't find much value in Jeremy's course nor the official book (sorry). This is hands on practical of what we've learned in ROUTE & SWITCH. Using and reusing the scenario from Keith should teach you some important things to remember when troubleshooting. Remember where your transition points are going from Layer 2 --> Layer 3; EIGRP --> OSPF; Inside --> Outside. Break it into smaller problems. Its hard to solve a big problem. Solve a bunch of small ones.
• Is your layer 2 good? Can you ping from client1 to DSW1?
• Is your internal EIGRP good?
• Is your OSPF to EIGRP transition clean?
• Is your OSPF good?
• Is your BGP to OSPF good?
• Is your BGP good?
• Is your inside to outside transition working?
• Know your routing show commands and what the output means
• Show ip route
• show ip protocols
• show ip route ospf
• show ip route eigrp
• show ip route bgp
• show ip ospf int
• show ip ospf neigh
• show ip eigrp int
• show ip eigrp neigh
• show ip bgp
• show ip bgp summary
• show ipv6 of the relevant items listed above
• Know your layer 2 commands
• show vlan
• show int trunk
• show port-security
• Know the scenario information
• show ip nat trans
• show access-list
• show ip access-list
• show ip dhcp bind
• show ip dhcp stat
• Know how to source your pings and traces
• Show run is your friend, but only at the end. Sifting through 10 devices worth of show run is going to take too long on 13-15 questions to finish in 120 minutes. The show run should be the last step to find the actual syntax of the mistake. The other shows should get you 95% of the way home.

Test Taking

• You are asked to find the device causing the problem, the technology in use, and the resolution to the problem.
• This was the only time I asked for a sheet of paper. Being left handed and smearing your notes suck. I usually wrote a quick note on the problem such as (C1 --> Web). Then I made notes on what wasn't working. for example, if the client couldn't ping DSW1 that's the note. When I found the device I thought had the error, I wrote its name down. I also wrote down the best guess of what I'd call the technology. Finally, on step 3 of the problem, they ask for the solution. Syntax matters. READ the possible answers. They will blur together and almost seem the same. UGH.

Good luck. My brain are tired :)

Passed -- Cisco 300-115 -- Switch

Another down! Yay! Thoughts and comments time

The Test:

• I used 87 of the allotted 90 minutes to complete 44 questions with a mid 900 score. Remember, there is no going back so you have to answer the question then and there when it is presented. Waiting for an moment of clarity later in the exam isn't an option. You gotta grind it out right then when the questions/scenario comes up.
• Two or three of the questions had 4-6 parts on configuration review, analysis, troubleshooting and remediation options/recommendations. These chewed a significant chunk of time. Most of it was spent reading the questions to figure out what they are really asking plus reviewing the configs. These are the ones where you truly want more screen space. It felt like most of the time was spent using show commands and having to maneuver windows so I could see the relevant information between two or three devices. I'm sure dual monitors would have saved me about 5-10 minutes here.
•  There were three configuration items. The configuration tasks were somewhat long. 
• The steps had to be completed in a specific order compared to what is permitted in real life. I'm sure most people would do the steps in the order I chose. For example, configuring AAA, I always configure my authentication sources first, then do the actual AAA methods. However, on the test, AAA methods had to be done first, THEN the authentication source commands worked. That took 5+ minutes of going, "WTF, is there another way of configuring RADIUS/TACACS servers I don't know and didn't practice?" So I launched into the AAA methods and all of a sudden I could do my AAA servers after that. Basically if the command you -know- works doesn't work right away, try another portion of the question. The failing command may all of a sudden work later. 
• The configuration tasks had LOTS of requirements on a couple of them. Some of the validation for the early items relied upon the completion of the later items. I probably could have read the full question two or three times to figure out what order to do the steps, but I didn't.
• As you type your commands and change interface status you may get messages (even if you administratively shutdown the interfaces). Int up, protocol up. 2 seconds later, Int down, protocol down. Pretend its the TV, and don't believe everything you see. Check your interfaces with your commands. Check the changes you made with the other show commands (trunk, channels, monitor, dot1x, whatever).
• There were a handful of review the exhibit, here's a problem, what's the most like cause or what is the best remediation option.
• The rest were standard multiple choice fare including edge cases, do you know the protocols well, do you know the difference between protocols, etc.
• I thought there were two questions with no right answers. Example, what happens to a standby track priority when the track interface goes down and comes back up. Essentially, nothing in my book. Yes, it decrements, but then it returns to normal value. The question asked about the end state value. No delta or up and return weren't on the list.

Study Material:

• I used CBTNuggets video series from both Jeremy and Keith along with the Safaribooks version of the 300-115 Study Guide from Cisco Press.
• Jeremy's was a good introduction to most the topics. There wasn't always a lot of meat in the material in regards to answering the last bullet above.
• Keith and Jeremy's labs were very good. Again, I got to the point I could do the labs on my equipment (or least type the commands in the right order and location) by just looking at the topic that was going to be covered. One of the important points in these labs if to listen if either of them say something that would make you think, EDGE-case question! I went through Keith's twice and a couple of Jeremy's twice to catch these. The second time through on the labs, I paused the video after the setup and goals were established and tried to complete the task without watching the video. Good practice for the exam simulators.
• The SafariBooks piece had all the extreme information, what the min, what is the max, what are the timers, what are the defaults, what are the ports/protocols, etc. Safari also covered RPR, RPR+, SSO, and NSF.
• Practice tests were those provided by CBTNuggets via Transcender and SelfTest. The content in these bordered on useless. It seemed like 40% of the material was old and dated and not on the test (wireless, voice, cef, etc). In addition the explanations were wrong. (vtp version 2, not vtp-mode v2 like the explanation given). These were used mostly to get used to deciphering the test questions.

Study Environment

• Pure GNS3, v1.3. I used the IOU L2 images along with c7200 routers when I could. These did most of the commands. Short-comings on the images I used
• SPAN/RSPAN doesn't work at all. Just typed the commands to practice.
• Private VLAN doesn't "work". The commands are permitted and required in the correct order. However, the configuration isn't supported so no functional changes are done but the commands are there. The show commands pretty much work, but tell you, yep, it doesn't work.
• 802.1x not fully implemented on interfaces
• radius-server host didn't exist
• lldp doesn't exist
• vlan acls do not work
• sdm is not there
• ip dhcp snooping doesn't work right. commands are available, but turning it on with trusted ports causes DHCP to break. DAI is not there at all.
• int vlan x; ip add x.x.x.x; t didn't always work between the IOU devices, especially with FHRP protocols. EIGRP/OSPF would neighbor great, but the FHRP simply wouldn't see each other. I had to use the 7200 routers to do FHRP practice.
• RPR, RPR+, SSO don't work (duh)
• Stackwise isn't there (duh)
• None of these were a deal-breaker. If the command wasn't supported, I just watched the video, typed the command at the right location, review the video results, moved on. Its all about repetition to memorize the commands.
• Another thought on the GNS3 for practice was seeing the odd messages that shouldn't appear with a admin down interface made the strangeness on the exam simulator not so shocking.

Overall, the test was pretty much what I expected. I think only one question surprised me in terms of content. The testing objectives lined up well and the official study material did well to cover the objectives. It didn't hurt having 15 years of managing 2000+ campus switches so a lot of it was old hat.

Anyhow, onto TSHOOT. Good luck.

Passed -- Cisco Route 300-101

I took the Cisco Route 300-101 exam today and some how managed to pass it. It was a long test for me as it took 87 of the 90 minutes allotted. This was due primarily to the simulations. I had trouble getting one working although I thought I had it configured correctly. I re-lab'd it up at home and it the solution worked as I expected it. Strange. Anyhow, a quick review.

I used the CBT Nuggets material and the Cisco authorized book via Safari Books Online. This pair seemed to work well. CBT provided the practice labs, the overview of most of the technologies covered, and the practice test from SelfTest and Transcenders. The book filled in the gaps when taking the practice tests. There were definitely questions in the practice tests that weren't in the Nuggets info. Having said all that, the items played well together and gave me enough information to pass.

The test was relatively short (under 60 questions), but 4-6 were simulations. Remember, this is a Cisco test so there is no going back so these have to be done when presented. I ran into some difficultly on a couple of them due to ... imprecise information. Some of the simulation questions required very precise subnet information, while others wanted me to grab the entire classful network. However, it wasn't clear until testing my solutions what they were looking for. Looking into the routing statements, interfaces, etc to help, simply didn't help. So I had to configure ACLs etc, multiple times, test each version, and clear out the wrong information. This drained my time very quickly on two questions as they took 15 minutes each. I had to leave one wrong (according the simulator, but not gns3 at home) and move on. I was 13 questions from finished with 15 minutes to go. Yikes. Luckily the last simulation was relatively easy for me and I finished at 2:45 left to go.

Anyhow, I like the idea of simulations and practical experience, but the engine needs some work still. Some commands aren't always available, but then you are given access to "show run" in the same question. Sometimes sifting through the run when a single concise show is faster. Next, there needs to be more screen space for the sims. Trying to view 4 routers consoles, the scenario question, and a diagram on a single monitor is a chore. I spent a lot of time flipping between those items while completing the simulations.

Last, I didn't like the fact that one topic was not covered at all in the test from the layer 3 techs area that required a significant effort while another single topic in infrastructure was hammered on 4 times. Maybe it was just luck of the draw.

Anyhow, onto switch while we hunt.

Job Hunting -- Job 1 Post-mortem

Job 1:

I was still in last 2 weeks of school when this opportunity arose. Bit of background, the job was 3 hours from where I live, but near my family. I applied online. Boys and girls, this is how I think you should do an interview process.

First, the Superintendent himself calls me. He tells me the job would like be a significant pay cut. (Yay! Set expectations early! This is good). I figured that going in so I said that is fine. He asked about why I was applying for a job so far away. I told him the reasons. He says he will call back to schedule the interview.

Two days later, he calls, and we schedule up the interview. He sends me directions, contact information, etc.

A week or two later, we have the interview with his team. They were looking for a different skill set than I brought to the table. Happens. I ask about timelines, etc. He set the expectation of about 5 days to expect them to select the candidate.

A week later, the Superintendent calls me. He says they went with another candidate. This is a hard call to make for most folks, but you gotta do it. He did. I told him thank you for letting me know and wished him well.

Overall, it was a positive experience. Personal calls and contact were made. Expectations were set from the get-go. Dates and timelines were generally kept.

Job Hunting or How to Lose a Candidate in 30 days

I've finished the degree. Yay! I've had a celebration vacation. Now it is time to start the job search and skill growth phase. I'll try to do some postings of the, uh, funny things that have happen so far in the job search. Stories 2 & 3. I'll tell story 1 soon enough.

I've recently applied online for a couple of jobs. Greatness. Anyhow, both resumes made it past the first bridge troll in HR (or automated troll) to get onto the next phase of review.

Job Two:

Sent me a series of email questions asking for responses. I know I'm IT oriented, but this was simply WRONG. Seriously, if one of the questions is salary range which can be a weed-out question due to an applicants requirements being outside of the range, why even ask the other questions. They wanted me to provide real depth to what I did in writing to questions like:

·Please describe the topology of the network at your most recent position and your role. Please be specific and include the vendor and model numbers of the equipment you managed, as well as the protocols used to connect neighboring devices and remote data centers.

· Please describe your Unified Communications experience, and any conversion projects in which you have participated. Please be specific, include your role, and the dates.

· What network tools did you manage and/or use to perform your daily job functions

Then don't ask what are your salary requirements in the same questionnaire if an applicant will be disqualified based upon that number. Go ahead and state it up front to the applicant. Otherwise, you are wasting my time and yours. I understand working in the public sector or in education. Sometimes, you are capped. Go ahead and state it up front what the range is, especially if it is a hard cap. I always had my Admin Asst call any applicant who were potential candidates and give the salary range. Saved a lot of wasted time for both parties. I also used that phone call to ask, if the candidate would share, what was an approximate salary they were looking for so we could potentially adjust our pay rates. Never happened -- the adjustment --, but at least it was easy to say why the process took so long or we had to take a candidate we'd have to train up. Lesson for all the HR people or hiring people or whoever will listen. If there exists a range, post it, let the candidates know. Sometimes, good tech people will take a pay cut to get the better hours, better work life balance (no on call 24/7!), new opportunity, etc.

Job Three:

Applied online. About a week later, a computer sent me an automated email asking me to schedule an interview online. Okay. Done. Scheduled it. Then the automated scheduler sent me a response to email the Admin Asst. confirming my interview. Sure. Done. She responded a day later. First real human contact. First clue on the environment.

Interview takes place. It runs 45 minutes long. Most of the time that means it is going well.

Week one goes by.

Week two goes by.

Week three, day 1: One of my references listed lets me know he's been contacted to schedule a call. My reference asks what to say. I tell him to do whatever he wants. He will anyway. Make shit up, tell the truth, don't care. Please note, the prospective employer hasn't contacted me.

Week three, day 3: Same reference says I'll likely be the finalist based on his call. Guess he wowed them. I hope it was with reality.

Week three, day 5: email from prospective employer asking me to fill out the rest of these forms as I am the finalist. Seriously. No other contact. No phone calls. No pay-rate discussions. No follow-up. Wow. On top of that, the emails say these are automated emails, and request that I don't respond to this address. However, the email later states I can contact them if I have any questions. No contact phone number nor email was listed though. 

Lesson for all. If you are hiring someone, stay in contact with the candidates. Use human methods, not automated emailers, regardless the size of your organization. Interviewing is like dating. You have to call, send email, text, whatever. This must be done with the preferred candidate often. Once every 2-3 days at worst. People like to be flattered. They like to feel important and wanted. Yeah, dumb human instinct, right? However, if this is my first interaction with you as a company and organization, how do you want to me to think of your organization? 

• That you called. You followed up. You kept me in the loop. You made sure I knew you were there if there were any questions I had. You thought I was important.
• You were quiet. You never said anything. You just disappeared. 0 communication. I'm just another cog in a machine.

Job Three is a pass based upon these simple things. I don't know if I'll even look to find out how to decline the opportunity. You get what you give. 

 

Job Three Update:

 

Today, the computer has asked me to go get fingerprinted via an automated email. So the standing orders from the computer are:

• Give us your personal info so we can run your background check
• Give us your college transcript so we can verify you went to school
• Give us your fingerprints so we can run your criminal history
• Give us your bank information so we can setup direct deposit
• Give us your citizen and ethnic status

Things not done by the prospective employer (or computer)

• Stay in contact with me. That includes no contact information to follow up. Nada. Zilch. 0.
• Notify me in a personal manner that I was the finalist.
• Discuss salary, job specifics, or anything related to the job since the interview.

Wow. Its almost like the computer wants to steal my identity. Automation and Technology has its place boys and girls, but when you are hiring for a position, you are hiring a person. Treat them as such.

I'm sure there will be more to this saga.

Job Three Update #2:

They finally presented an offer, in email of course. It really looks like a form email, but sometimes HR is told to keep it bland to ensure no "bad' things can happen. Its on okay offer. Probably about the same per hour as when I left to get a degree. I find it amazing no one from the group I interviewed with has chosen to make a personal attempt to contact me for nearly 4 weeks. Yes, I know, if I wanted the job, I'd do the contacting. However, I have received 0 contact information except for the Admin Asst's email.

Job Three Update #3:

I declined the offer stating the position didn't match my career goals. Now, they are asking if it is the pay that cause me to decline. To no one's surprise, the question was in the form of an email. Again, you are hiring a person, not an email correspondent. Time to politely formulate an answer.

Job Three Update #4:

Ha! A phone call from the person with the position asking what they can do to get me in there. This is almost comical. Its hard to maintain some sort of professionalism with all this automation and actually pick up the phone and return the call now.