SmartZone 100 and Palo Alto IP address to user name (User-ID) mapping

So after a call with Ruckus, I was informed that this functionality was stripped from the SmartZone 100 controllers "by design" and "all I needed to do" was purchase CloudPath and pay for per-user licensing to get username and IP addresses on client join events.

I am not the only one looking for this functionality, it has apparently been submitted by numerous organizations and is currently classified as a Feature Request.  Given that "all I need to do" is pay for CloudPath and the problem is solved, I highly doubt this Feature Request will ever be implemented in the SmartZone 100 controllers.

A quick look shows CloudPath licensing at around $36.99 per user at full retail price.  This doesn't include the cost to purchase CloudPath licenses and whatever additional costs there may be associated to that.  Needless to say, it is horrendously cost prohibitive when in an environment of around 2000 connected end users at any given time when you already have the systems in place to manage your BYOD and enterprise wifi networks.

This was functionality that was native in the ZoneDirector 3000, which to my understanding the SmartZone controllers are replacing.  By appearances Ruckus now expects us to pay through the nose for this functionality via CloudPath.

Well done Ruckus....  Well done.  

Hi,

I was in a similar situation and my local representative recommended me this script (in case you are using Windows Server):
https://github.com/cesanetwan/uid-radius-script-ps/wiki

This script is basicially triggered every time a NPS-login occurs. As the real username and Mac-Address are available in this login-event it searches for a corresponding DHCP release and then tranmits the result to the Palo Alto via the API.
I guess it would be possible to port this script to Linux and get the MAC->IP mapping from the SmartZone API (to make this script universable useable for Ruckus). However in my environment this was not necessary.

Hope it helps. :)

I also would like this feature reinstated, and as a prior customer of cloudpath, we steered away from it, as it was not the best experience for our clients, as well it did not justify the huge cost.

I have been in contact with Ruckus who have now fixed the syslog bug so it works correctly!

The Palo Alto regex I am using is the following,
Device > User Identification > Palo Alto Networks User-ID Agent Setup(the tiny cog on the top right) > Syslog Filters
Type: Regex Identifier
Event Regex: (?=.*clientInfoUpdate)(.*"ssid"="YourWirelessSSID")(.*"clientIP"=")
Username Regex: "userName"="([a-zA-Z0-9.\-\_\\]+)
Address Regex: "clientIP"="(\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b)

You can also remove the requirements for a specific SSID you can use the following,
Event Regex: (?=.*clientInfoUpdate)(.*"clientIP"=")

Dont forget to turn on "Allow matching usernames without domains" for the Palo Alto to allow it to digest logins without the domain if you use RADIUS for auth.
on the Palo Alto you turn on the following,
Device > User Identification > Palo Alto Networks User-ID Agent Setup(the tiny cog on the top right) > Cache > Allow matching usernames without domains(tick box)

Server Monitor also needs to be setup,
Add the Device > User Identification > Server Monitor
Type: Syslog Sender
Network Address: IP of the SmartZone controller
Connection: UDP
Add the Ruckus Regex under "Syslog Parse Profile"


The SmartZone Controller has the following settings,
System > General Settings > Syslog
Enable Syslog
Primary Syslog: Palo Alto Management interface IP(the default for user auth)
Port: 514
Protocol: UDP

Event Filter: All Events above a severity
Event Filter Severity: Informational

So to update from my last post. 

This works, most of the time. I have noticed that some of my users and not being seen correctly by the firewall from the syslog. I am getting org\\user instead of org\user and the PA drops that past my unknown user to the bottom of the security rules. 

To resolve this I am using both of the suggestions here and it seems to be working better but still seeing the double \\. 

Going to toss this one to PA