Aruba Networks ClearPass

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai Help Center and we shall get it updated.

This guide describes the steps required to configure Aruba Networks ClearPass to send logs to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Syslog Configuration

Follow the below steps in ClearPass Policy Manager to enable syslog output to the local collector.

1. Add a Syslog Target using the following parameters:
   

   Parameter	Value
   Host Address	IP of the Samurai Local Collector
   Protocol	TCP
   Server Port	514

2. Create Syslog Export Filters for each event type using the following parameters:
   

   Parameter	Value
   Export Template	Audit Records, Insight Logs and Session Logs
   Export Event Format Type	CEF
   Syslog Servers	Syslog target created in the above step

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR Application as we auto detect the vendor and product. The only reason you need to use the Samurai MDR Application is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning!  See Integrations for more information on checking status.