Can a Palo Alto be set up to forward client IP addresses to Mirket?
When integrating Mirket's RADIUS server with the Palo Alto GlobalProtect Gateway for client or portal access, you might notice that Mirket's RADIUS authentication logs display the endpoint IP as N/A. This occurs because Palo Alto does not utilize the conventional RADIUS attribute, Calling-Station-Id, to transmit the client's IP address. Instead, starting with PAN-OS version 7, Palo Alto introduced a new RADIUS attribute, PaloAlto-Client-Source-IP, specifically for this purpose. Mirket has incorporated support for the PaloAlto-Client-Source-IP attribute to accurately gather end-user IP addresses.
Access the administration shell of the PA device via SSH and activate the transmission of the PaloAlto-Client-Source-IP attribute for client IP addresses by comment below.
set authentication radius-vsa-on client-source-ip
Last updated