Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

ON THIS PAGE

Aruba ClearPass Policy Manager

 

The JSA DSM for Aruba ClearPass Policy Manager can collect event logs from your Aruba ClearPass Policy Manager servers.

The following table identifies the specifications for the Aruba ClearPass Policy Manager DSM:

Table 1: Aruba ClearPass Policy Manager DSM Specifications

Specification

Value

Manufacturer

Aruba Networks

DSM name

ClearPass

RPM file name

DSM-ArubaClearPass-JSA_version-build_number.noarch.rpm

Supported versions

6.5.0.71095

Event format

LEEF

Recorded event types

Session

Audit

System

Insight

Automatically discovered?

Yes

Includes identity?

Yes

Includes custom properties?

No

More information

Aruba Networks website (https://www.arubanetworks.com/products/security/)

To integrate Aruba ClearPass Policy Manager with JSA, complete the following steps:

  1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the https://support.juniper.net/support/downloads/ onto your JSA console:

    • Aruba ClearPass DSM RPM

    • DSMCommon RPM

  2. Configure your Aruba ClearPass Policy Manager device to send syslog events to JSA.

  3. If JSA does not automatically detect the log source, add an Aruba ClearPass log source on the JSA Console. The following table describes the parameters that require specific values for Aruba ClearPass Policy Manager event collection:

    Table 2: Aruba ClearPass Policy Manager Log Source Parameters

    Parameter

    Value

    Log Source type

    Aruba ClearPass Policy Manager

    Protocol Configuration

    Syslog

Configuring Aruba ClearPass Policy Manager to Communicate with JSA

To collect syslog events from Aruba ClearPass Policy Manager, you must add an external syslog server for the JSA host. You will then need to create one or more syslog filters for your syslog server.

For Session and Insight events, full event parsing works only for the default fields that are provided by Aruba ClearPass Policy Manager. Session and Insight events that are created by a user, and have different combinations of fields, might appear as Unknown Session Log, or Unknown Insight Log.

  1. Log in to your Aruba ClearPass Policy Manager server.
  2. Start the Administration Console.
  3. Click External Servers >Syslog Targets.
  4. Click Add, and then configure the details for the JSA host.
  5. On the Administration Console, click External Servers >Syslog Export Filters
  6. Click Add.
  7. Select LEEF for the Export Event Format Type, and then select the Syslog Server that you added.
  8. Click Save.

Related Documentation