Palo Alto Networks User-ID Services Unified Visitor Management
Copyright © 2011 Aruba Networks, Inc. Aruba Networks trademarks include Airwave, Aruba Networks®, Aruba Wireless Networks®, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management System®, Mobile Edge Architecture®, People Move. Networks Must Follow®, RFProtect®, Green Island®. All rights reserved. All other trademarks are the property of their respective owners.
Table of Contents 1 Introduction ................................................................................................................................... 4 Audience .................................................................................................................................... 4 Document Overview................................................................................................................... 4 Disclaimer ......................................................
1 Introduction This technical note demonstrates how Palo Alto Networks customers can leverage Amigopod to provide User Identity tracking for both known corporate users (via Active Directory, eDirectory etc) and now Guest &/or Public Access users accessing the Internet through their Guest Access or Hotspot networks.
2 About Palo Alto Networks User-ID Services Overview Palo Alto Networks have developed a range of Next Generation firewalls that redefine the best practice for controlling and securing today’s networks. Leveraging their core strengths of Application, User and Content Identification, Palo Alto Networks provides a unique approach to addressing the challenges surrounding Web 2.0 applications and peer to peer communications which dominate the concerns of IT Administrators.
Palo Alto Networks User-ID Services Architecture Amigopod is typically deployed in conjunction with a Wired or Wireless Access Controller to provide a clean branded user experience, user session management and many other innovative enhancements to a traditional Guest or Public Access solution. The additional of an upstream Palo Alto Networks firewall adds a wealth of security and traffic management features to these networks.
3 Network Design The following diagram shows a sample network architecture where a typical Guest Access network is delivered by an Aruba Networks wireless solution. The Aruba controller that performs authentication and access control tasks for the wireless users has been complemented by the integration of both the Amigopod and Palo Alto Networks technology.
4 Configuring Palo Alto Networks User-ID Services Check Plugin Versions Pushing user identity information to a Palo Alto Networks firewall requires the following Amigopod plugin versions: • Amigopod Kernel 2.1.7 or later • RADIUS Services Plugin 2.1.7 or later • Guest Manager Plugin 2.1.6 or later • Palo Alto Networks Networks Services 0.6.
Configuring the Palo Alto Networks User-ID Service To configure the Palo Alto Networks plugin: 1. Click on the Configuration option of the Palo Alto Networks Plugin shown in the Manage Plugins list. 2. To start the XML API service, click the Enable checkbox to enable the plugin. Amigopod leverages its advanced RADIUS authentication engine to allow the Palo Alto Networks XML API calls to be made every time there is a successful RADIUS login or logout.
• 4. Username Suffix: The Palo Alto Networks plugin versions 0.7.0 and later allow you to optionally specify a suffix to add to usernames, e.g., #{$user.sponsor_name} Click Save Configuration to save your settings. The configuration of the plugin is complete. Check Palo Alto Networks Version and Setup Palo Alto Networks firewalls and Agent Software are required to be running the following software releases in order to support the XML API for the User-ID integration: • Firewall Software Version 3.1.
Configuring User-ID Agent Definition From the Device > User Identification screen click Add under the User Identification Agent section shown below: From the resulting screen enter the IP Address details of the Windows Host you have installed the Palo Alto Networks User-ID Agent software. In our test environment the Windows host has an IP Address of 10.0.20.53. A port must also be defined for communications between the Palo Alto Networks firewall and the User-ID Agent software on the Windows host.
Enable Zone Based User Identification An additional step is required to enable the User Identification process on the Palo Alto Networks firewall is based on the configuration of the Zones that any interesting traffic with pass through. In our test environment all traffic is passing between the Trust and UnTrust zones so it is these zones whose configuration will need modification.
Once installed, you can launch the Agent software from the Start > Program Files > Palo Alto Networks > User-ID Agent menu option. The following start up screen will be displayed: Click the Configure option in the left navigation pane to complete the configuration of the Agent software. From the Configure screen the Device Listening Port must be configured to match that of the setting on the Palo Alto Networks firewall in the previous section. In our example the port selected was 8888.
Additionally ensure that the User-ID API option has been checked. You will then see the option below Configure that allows further configuration of the User-ID API settings. From the User-ID API configuration screen, leave the default listening port as 5006 as this is what the Amigopod default setting is in the Palo Alto Networks User-ID Services plugin.
5 Verify Integration Create Test Account in Amigopod In order to test the integration between Amigopod and Palo Alto Networks we need to get a valid RADIUS authenticated session initiated on the Aruba wireless network. From the Amigopod Guest Manager > Create Guest menu option, enter the details for a new test account and click the Create Guest button to save the account to the Amigopod database.
Login via Captive Portal page Assuming your Wired or Wireless Access controller is setup correctly when a web browser is opened on the test wireless laptop the browsing session should be automatically redirect to the Amigopod Web Login page. Login using the test account created in the previous step. Once you have been successfully authenticated you will be either redirected to a configured landing page or onto your original destination.
Monitor User-ID Agent Based on this successful RADIUS authentication transaction, the Amigopod Palo Alto Networks User-ID plugin will have executed an XML API call to the User-ID Agent software to inform the Palo Alto Networks of the new IP Address to User mapping. Returning to the main screen of the User-ID Agent we can see that the Amigopod has successfully sent an XML API update informing about the new IP Address to User identity mapping.
Verify User Identity Availability The final test is to verify that the IP Address to User identity mapping has been successfully committed to the Palo Alto Networks firewall from the User-ID Agent. From the Palo Alto Networks user interface select the Monitor tab to display the most recent traffic analysis. You should now see the From User column successfully populated with the user identity of the test user created in Amigopod.
Logout and Verify User Mapping Removed Use the Access Controller’s logout procedure to successfully terminate the Guest Access session and hence initiate at RADIUS stop record being sent from the Access Controller to the Amigopod. This will trigger another API update from the Amigopod to the User-ID Agent running on the Windows host. Returning to the Monitor tab on the Palo Alto Networks user interface you can now see that all subsequent traffic from the IP address in question (10.0.20.
6 Summary The necessity for application and user level visibility is today compounded by the explosion in requests for on demand Internet access. Whether its corporate guest access, a coffee shop hotspot or free wireless at a sporting event, users want to connect as easily and quickly as possible from a range of devices.
