ClearPass. ClearPass Extension for ServiceNow CMDB. ClearPass Extension for ServiceNow CMDB TechNote

Transcription

1 ClearPass Extension for ServiceNow CMDB TechNote ClearPass Extension for ServiceNow CMDB ClearPass TechNote ClearPass Extension for ServiceNow CMDB - TechNote 1

2 ClearPass Extension for ServiceNow CMDB TechNote Change Log Version Date Modified By Comments 0.1 Sept 2016 Danny Jump Initial Draft 0.2 Jan 2017 Danny Jump Incorporate early beta customer feedback 0.3 Jan 2017 Bob Filer Format cleanup and wordsmithing 0.4 Jan 2017 Bob Filer Additional minor edits 1.0 Jab 2017 Danny Jump First Published Version Copyright Copyright 2017 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett- Packard Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett-Packard Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA Please specify the product and version for which you are requesting source code. You may also request a copy of this source code free of charge at HPE-Aruba-gplquery@hpe.com. ClearPass Extension for ServiceNow CMDB - TechNote 2

3 ClearPass Extension for ServiceNow CMDB TechNote Contents Introduction and Overview... 5 Software Requirements... 5 ClearPass Installation and Deployment Guide... 5 ClearPass Extensions... 5 Pictorial View of the Integration... 5 ServiceNow Extension Installation and Configuration... 6 Create an Extension API Operator Profile... 6 Create an API Client... 7 Generate an Access Token... 8 Go to the Extension APIs... 9 Install the Extension Query Extension after Installation Configure the Extension Starting the Extension Verify the Extension is Running Troubleshooting the Extension Configure ClearPass Policy Manager Add HTTP Authorization Source Using Results from SNOW in an Enforcement Policy Appendix A List of Default SNOW Attributes Appendix B Listing SNOW Custom Fields Appendix C Additional Diagnostics and Support Checking on the Extension Service Extension Logs/Debugging Accessing the extension logs using Collect Logs system function Appendix D Considerations for Installing in a Cluster Extension Installation Procedure for a Subscriber Extension IDs in a Cluster ClearPass Extension for ServiceNow CMDB - TechNote 3

4 Figures Figure 1: Pictorial view of the ClearPass integration with SNOW... 6 Figure 2: Duplicate API Guest Operator profile... 7 Figure 3: Modifying Operator Profile permissions for extensions... 7 Figure 4: Creating your API client... 8 Figure 5: Generate the Access Token... 9 Figure 6: API Explorer UI... 9 Figure 7: Accessing the Store API... 9 Figure 8: Checking in the Extension store for a particular Extension ID Figure 9: Details of the Extension Figure 10: Installing the Extension directly from the Extension store Figure 11: Extension Status Figure 12: Checking Extension Installation Progress Figure 13: Response to check on progress of Extension installation Figure 14: Get Extension configuration Figure 15: Response to a request for the Extension configuration Figure 16: Configuring the Extension Figure 17: Starting the Extension Figure 18: Expected HTTP response to InstanceStart Figure 19: Checking on the state of the Extension Figure 20: Detailed information on the running Extension Figure 21: Getting Debug Logs from the Extension Figure 22: Adding an HTTP authz source Figure 23: Adding HTTP authorization source credentials Figure 24: Adding HTTP authorization source query string and returned field definitions Part Figure 25: Adding HTTP authorization source query string and returned field definitions Part Figure 26: Example of an Enforcement Policy utilizing attributes returned from SNOW Figure 27: Services Control Figure 28: Setting debug logging on Figure 29: Getting Logs out of an extension Figure 30: Locating the Extension logs from 'Collect Logs' diagnostic GZ file Figure 31: Subscriber with no "Generate Key" option Figure 32: Generate API Key in Publisher and copy it Figure 33: Entering the HTTP Authorization key into the Subscriber ClearPass Extension for ServiceNow CMDB - TechNote 4

5 Introduction and Overview This TechNote covers the setup, configuration, and monitoring of the ServiceNow [SNOW] ClearPass Extension within ClearPass Policy Manager. ClearPass Extensions are micro-services running on top of the base ClearPass platform. These micro-services enable Aruba to deliver new features outside of the main software release cycle, facilitating a faster time to market for a specific feature. Configuration and control of ClearPass Extensions is accomplished through the ClearPass REST API. Prior to accessing the APIs, some preconfiguration needs to be completed. This is covered in the Installation, Configuration and Setup section below. Software Requirements The minimum software version required for ClearPass is At the time of writing, ClearPass is the latest available and recommended release. Any subsequent ClearPass software release will support this integration. ClearPass runs on either hardware appliances with pre-installed software, or as a Virtual Machine under the following hypervisors. Hypervisors that run on a client computer such as VMware Player are not supported. VMware ESXi 5.0, 5.1, 5.5, 6.0, or higher Microsoft Hyper-V Server 2012 R2 Hyper-V on Microsoft Windows Server 2012 R2 KVM on CentOS 6.6, 6.7, or 6.8. ClearPass Installation and Deployment Guide This document assumes your ClearPass environment is already configured and operational. If you require assistance with basic deployment, refer to the following deployment guide: ClearPass Extensions The integration between ClearPass Policy Manager and ServiceNow is driven through a ClearPass capability known as Extensions, a sub-component of the ClearPass Exchange Integration framework. ClearPass Extensions are micro-services running on top of the base ClearPass platform. These micro-services enable Aruba to deliver new features outside of the main software release cycle and facilitate a faster time to market for specific features and integrations. Configuration and control of ClearPass Extensions is accomplished through the ClearPass REST APIs. Pictorial View of the Integration The diagram below shows a pictorial overview of the components in this solution, and how they interact with each other. ClearPass Extension for ServiceNow CMDB - TechNote 5

6 Figure 1: Pictorial view of the ClearPass integration with SNOW ServiceNow Extension Installation and Configuration Installation of the SNOW ClearPass Extension is performed via the REST API interface. ClearPass REST APIs were initially introduced in CPPM 6.5 and have continued to be enhanced in subsequent releases. Access to the APIs is through the following URL You have to provide Admin credentials as usual to access the API interface. Note: the APIs to support ClearPass Extensions were initially released in CPPM version 6.6. Several components, and multiple steps, are required to complete the ClearPass configuration: Extension Installation and Configuration Context Server Configuration Context-Server-Actions Configuration New or Existing Enforcement Policy Configuration The ClearPass extension installation is shown below. Follow these steps to enable the extension to communicate with the SNOW APIs. Create an Extension API Operator Profile Before setting up the API access, you must configure an Operator Profile that will be associated with the configured API client. This new Operator Profile will be used in the next section when creating the API Client. ClearPass Extension for ServiceNow CMDB - TechNote 6

7 Login to Guest and go to Administration > Operator Logins > Profiles. Next, click on API Guest Operator and select Duplicate. Figure 2: Duplicate API Guest Operator profile ClearPass will copy the profile and name it API Guest Operator (2). Click Edit on the new profile and rename it to be API Extension Profile. For the Platform privilege, change No Access to Custom and then set all the Extension options as shown below (furthest option to the right). Scroll to the bottom of the page and click Save. Figure 3: Modifying Operator Profile permissions for extensions In the next step, this profile will be used as the Operator Profile when generating the API Client. Create an API Client The next step in installing and enabling the ServiceNow ClearPass Extension is to create an API Client. An API client provides authentication and authorization for the REST APIs. Authentication is performed using OAuth2, which is an authorization framework that enables applications to obtain limited access to data over ClearPass Extension for ServiceNow CMDB - TechNote 7

8 a HTTP service without sharing their private credentials. Log into ClearPass Guest at ClearPass-Server>/guest. Navigate to Guest > Administration > API Services > API Clients and create an API client by entering the following: 1. Client ID: Your choice 2. Operator Profile: API Extension Profile [just created] 3. Grant Type: Client credentials Figure 4: Creating your API client Note: Keep a record of the Client Secret as it won't be displayed again. Click on Create API Client to save and create the API Client. Generate an Access Token Click Generate Access Token and then launch the API Explorer, as highlighted below at the bottom of the image. ClearPass Extension for ServiceNow CMDB - TechNote 8

9 Figure 5: Generate the Access Token This will pre-populate the Authorization header in the API Explorer and allow you to try commands directly from the ClearPass UI. Go to the Extension APIs Click on Extension > Store Figure 6: API Explorer UI Under Store, click GET /extension/store/{id} Figure 7: Accessing the Store API ClearPass Extension for ServiceNow CMDB - TechNote 9

10 Notice that the Authorization header is populated. This is populated from creating the token in the previous step. Next you should expand the GET /extension/store/{id} and paste in the extension's store ID. Note: The store ID for the SNOW extension is a fixed value of: 3027ed5e-5a87-42ea-85fa-d9454cc4029c Click Try it out! Figure 8: Checking in the Extension store for a particular Extension ID Note: Remember that the store ID of 3027ed5e-5a87-42ea-85fa-d9454cc4029c is unique to this version of the SNOW Extension. The store ID will change as new versions of the Extension are published. This will return details for the SNOW Extension, and provides assurance that you have access to the Extension Store and this is the correct ID for the extension you want to install. Figure 9: Details of the Extension ClearPass Extension for ServiceNow CMDB - TechNote 10

11 Install the Extension After checking for extension visibility, the next step is to install it. Under Instance > POST /extension/instance, paste in the body as shown below: {"state": "stopped", "store_id":"3027ed5e-5a87-42ea-85fa-d9454cc4029c "} And then click Try it out! Figure 10: Installing the Extension directly from the Extension store Note: This will return an Extension ID (Note: this is different from the store ID). Make a copy of this ID [run-time ID] as it will be required later. Notice in the JSON body, the extension is installed in the stopped state. The below shows the state of the Extension as preparing. This indicates it is successfully installed and is deploying. The state may also show installing. A typical installation should take just a few seconds to complete. ClearPass Extension for ServiceNow CMDB - TechNote 11

12 Figure 11: Extension Status From the above, you can see the Extension ID is f4f3e f-46ed-a12e-a59c814efd04.this ID will be used to query and configure the extension. Warning: Your Extension ID will be different from the one used here. It is generated per installation and is unique to each installation. Query Extension after Installation Under Instance > GET /extension/instance/{id}, paste in the ID from the previous step: f4f3e f- 46ed-a12e-a59c814efd04 and click Try it out!; remember your ID will be different. Figure 12: Checking Extension Installation Progress ClearPass Extension for ServiceNow CMDB - TechNote 12

13 Within the Body Response from this GET you should see the following: Figure 13: Response to check on progress of Extension installation The details of the extension will be displayed (could be downloading, etc.). Eventually the state will change to either stopped or failed. In this example it is clear the that the installation is created and stopped. Configure the Extension The extension must be configured before it can be started. Begin by getting the current configuration. Under InstanceConfig > GET /extension/instance/{id}/config, paste in the extension ID f4f3e f- 46ed-a12e-a59c814efd04 and click Try it out! to return a copy of the current Extension configuration. Figure 14: Get Extension configuration ClearPass Extension for ServiceNow CMDB - TechNote 13

14 Figure 15: Response to a request for the Extension configuration The above example, shows the default shipping configuration. This needs to be changed to match your environment. In the example configuration shown, there are 5 configuration parameters that can be changed: servicenowuri, servicenowuser, servicenowpasswd, verifysslcerts, loglevel. The use of these configuration options will be explained later. Note: The configuration properties available for the extension will be displayed in JSON format. Under Instance > PUT /extension/instance {id}/config, paste in the extension ID and the configuration you just prepared as shown below and click Try it out!. Figure 16: Configuring the Extension The response if the configuration is successfully formatted, should be a 204. Following this step the extension can now be started. Under InstanceStart > POST /extension/instance/{id}/start paste in the extension ID and click Try it out!. A successful response will be a 204. Note: If the configuration is changed, it is best practice to restart the extension via InstanceRestart > POST /extension/instance/{id}/restart ClearPass Extension for ServiceNow CMDB - TechNote 14

15 Starting the Extension Under InstanceStart > POST /extension/instance/{id}/start, paste in the extension ID and click Try it out!. Figure 17: Starting the Extension A successful result is indicated by a 204 No Content result as shown below. Figure 18: Expected HTTP response to InstanceStart Verify the Extension is Running Under Instance > GET /extension/instance/{id} copy and paste the extension ID and click Try it out! Figure 19: Checking on the state of the Extension ClearPass Extension for ServiceNow CMDB - TechNote 15

16 The state of the extension should be running. An example of the HTTP response is shown below: Figure 20: Detailed information on the running Extension Note: The internal_ip_address of the extension will be auto-configured. This will be used for configuring the authorization source later in ClearPass, make a note of this value. Troubleshooting the Extension Under InstanceLog > GET /extension/instance/{id}/log, paste in the extension ID. Enter a value for tail, e.g. 100 will show the last 100 lines of logs, then click Try it out!. Note that other settings are applicable when getting logs, e.g. timestamps. Figure 21: Getting Debug Logs from the Extension ClearPass Extension for ServiceNow CMDB - TechNote 16

17 Configure ClearPass Policy Manager Following the deployment and configuration of the ClearPass Extension, the next step is to configure an HTTP authorization source within ClearPass for the SNOW Extension. Multiple use-cases exist, such as: Ensuring that the endpoint is a known asset and therefore owned by the company before it s allowed to access the network Using specific endpoint data about the device, such as the installed O/S, to make a better policy decision in how this device can be granted or denied access to the network Add HTTP Authorization Source The first step is to add the authorization source. Under Configuration > Authentication > Sources, click Add and choose type HTTP. Figure 22: Adding an HTTP authz source Provide a Name for the Authentication Source and click Next. On the Primary Tab, provide the IP Address of the extension we recorded previously. Note: The Base URL is the IP address previously recorded when the extension was started. The Login Username and Password can be set to ANYTHING; they are not used by this extension but the parameters are mandatory. Figure 23: Adding HTTP authorization source credentials ClearPass Extension for ServiceNow CMDB - TechNote 17

18 Click on Next. This will advance to the Attributes Tab where you must configure at least on attribute. Click on Add More Filters. Provide a Name for the filter and then a Filter Query. The query is indexed off the MAC Address of the endpoint. Copy the line below and paste into the Filter Query box.?macaddress=%{connection:client-mac-address-nodelim} Caution: It s extremely important that the Filter Query is defined correctly. This is the query string sent to the SNOW Extension requesting context about the endpoint. Figure 24: Adding HTTP authorization source query string and returned field definitions Part1 The data that is returned from SNOW can be extensive. Care should be taken to understand exactly what data is required. Regardless of the data used, all of it will be returned. Carefully choose which attributes are required within your enforcement profile. As an example, the filter shown below has numerous attributes, but yours may well differ depending on the use-cases you are trying to meet. A complete list of the available fields is shown in Appendix A. Figure 25: Adding HTTP authorization source query string and returned field definitions Part2 ClearPass Extension for ServiceNow CMDB - TechNote 18

19 Note: In addition to the returned attributes from SNOW, one attribute, system_found, is added by the extension before that data is returned to ClearPass. This field is used to simply tell ClearPass whether the asset was found [known endpoint] or if it s an unknown device. Next build the definitions of the attributes that will be returned from the Filter Query. These attributes will subsequently be used within the policy evaluation and ultimately the enforcement policy that will be applied. If additional fields are required to make different authorization checks, then they will need to be defined in the above filter. Once the above filter is defined, click Save. Once the HTTP authorization source is defined, the returned attributes can be used in your policy processing. Below are some examples of how to use the results from the authorization query in a simple enforcement policy. Using Results from SNOW in an Enforcement Policy Multiple use cases exist for how the data returned from SNOW can be used in your policy-enforcement. In the example below, multiple checks are performed. 1. Check that the device exists in SNOW, i.e. it's a known endpoint/device. 2. If SNOW returns a comp_os_domain of DJJ-LAB, this device is to have special requirements. 3. If the device doesn t exist in SNOW, consider it unmanaged and take appropriate action. Figure 26: Example of an Enforcement Policy utilizing attributes returned from SNOW This is just a representative configuration, showing what you can do with the returned attributes. An assumption is made that you are familiar with the basics of building enforcement profiles and adding them into a new or existing enforcement policy within ClearPass. Note: This is a very short list of example use-cases. In Appendix A is a complete list of returned attributes from SNOW. Refer to Appendix B for the procedure on how to access custom attributes. ClearPass can be easily manipulated to use any of the endpoint context in this list to drive enforcement actions. ClearPass Extension for ServiceNow CMDB - TechNote 19

20 Appendix A List of Default SNOW Attributes Below is a list of ALL the default returned attributes available from SNOW. Depending on your deployment scenario, there could well be additional attributes [custom] which you want to use to validate the endpoint prior to it accessing the network. Retrieving custom attributes is covered in Appendix B. "net_checked_in": "unknown", "net_unverified": "false", "net_location": "unknown", "net_ip_default_gateway": " ", "net_po_number": "unknown", "net_justification": "unknown", "net_netmask": " ", "net_correlation_id": "unknown", "net_u_b_configdata": "unknown", "net_supported_by": "unknown", "net_sys_tags": "unknown", "net_mac_manufacturer": "unknown", "net_u_b_db_infraoptimization": "unknown", "net_sys_mod_count": "0", "net_first_discovered": "unknown", "net_cost_cc": "USD", "net_u_b_apps_infrastructure": "unknown", "net_owned_by": "unknown", "net_u_b_domainenterpriseadmin": "unknown", "net_u_it_workflow": "unknown", "net_gl_account": "unknown", "net_monitor": "false", "net_asset": "unknown", "net_managed_by": "unknown", "net_u_b_privileged_dbaccess": "unknown", "net_maintenance_schedule": "unknown", "net_u_b_workflow": "unknown", "net_sys_updated_on": " :01:32", "net_warranty_expiration": "unknown", "net_invoice_number": "unknown", "net_cost": "unknown", "net_fqdn": "unknown", "net_category": "Hardware", "net_ip_address": " ", "net_u_it_code_deployment": "unknown", "net_u_it_app_infra": "unknown", "net_last_discovered": "unknown", "net_manufacturer": "unknown", "net_company": "unknown", "net_due": "unknown", "net_delivery_date": "unknown", "net_install_status": "1", "net_asset_tag": "unknown", "net_discovery_source": "unknown", "net_assignment_group": "unknown", ClearPass Extension for ServiceNow CMDB - TechNote 20

21 "net_can_print": "false", "net_dns_domain": "unknown", "net_department": "unknown", "net_support_group": "unknown", "net_dhcp_enabled": "true", "net_sys_created_on": " :01:32", "net_u_it_db_infra_and_op": "unknown", "net_u_b_privileged_sysaccess": "unknown", "net_change_control": "unknown", "net_cost_center": "unknown", "net_short_description": "unknown", "net_u_it_app_level_user_role": "unknown", "net_checked_out": "unknown", "net_u_it_config": "unknown", "net_sys_updated_by": "DannyJump", "net_name": "[ ] Intel(R) Centrino(R) Advanced-N 6200 AGN", "net_purchase_date": "unknown", "net_u_it_priveleged_db_access": "unknown", "net_order_date": "unknown", "net_due_in": "unknown", "net_skip_sync": "false", "net_lease_id": "unknown", "net_u_b_applvl_userrole": "unknown", "net_alias": "unknown", "net_install_date": "unknown", "net_u_it_domain_enterprise_admins": "unknown", "net_sys_id": "b e819000d6c2316de7548e0", "net_assigned": "unknown", "net_u_b_os_sys_patch": "unknown", "net_u_b_code_deployment": "unknown", "net_sys_created_by": "DannyJump", "net_serial_number": "unknown", "net_assigned_to": "unknown", "net_mac_address": "00:27:10:5c:c0:70", "net_u_it_priveleged_sys_access": "unknown", "net_model_number": "unknown", "net_schedule": "unknown", "net_subcategory": "Network", "net_sys_class_name": "cmdb_ci_network_adapter", "net_u_it_os": "unknown", "net_attributes": "unknown", "net_fault_count": "0", "net_start_date": "unknown", "net_operational_status": "1", "net_comments": "unknown", "comp_cpu_count": "1", "comp_checked_in": "unknown", "comp_po_number": "unknown", "comp_correlation_id": "unknown", "comp_supported_by": "unknown", "comp_u_b_configdata": "unknown", ClearPass Extension for ServiceNow CMDB - TechNote 21

22 "comp_u_b_db_infraoptimization": "unknown", "comp_first_discovered": " :01:27", "comp_u_b_apps_infrastructure": "unknown", "comp_owned_by": "unknown", "comp_os": "Windows 7 Professional", "comp_u_b_domainenterpriseadmin": "unknown", "comp_u_it_workflow": "unknown", "comp_gl_account": "unknown", "comp_managed_by": "unknown", "comp_maintenance_schedule": "unknown", "comp_hardware_status": "installed", "comp_category": "Hardware", "comp_os_address_width": "32", "comp_cpu_name": "Intel(R) Core(TM) i5 CPU M 2.53GHz", "comp_u_it_app_infra": "unknown", "comp_delivery_date": "unknown", "comp_install_status": "1", "comp_virtual": "false", "comp_cd_rom": "false", "comp_dns_domain": "unknown", "comp_disk_space": "297", "comp_u_it_db_infra_and_op": "unknown", "comp_default_gateway": "unknown", "comp_change_control": "unknown", "comp_os_domain": "arubanetworks.com", "comp_checked_out": "unknown", "comp_purchase_date": "unknown", "comp_u_it_priveleged_db_access": "unknown", "comp_order_date": "unknown", "comp_cpu_speed": "2534", "comp_skip_sync": "false", "comp_lease_id": "unknown", "comp_vendor": "unknown", "comp_sys_id": "bf e819000d6c2316de754837", "comp_cpu_type": "unknown", "comp_cd_speed": "unknown", "comp_sys_created_by": "SOAPAUTH", "comp_u_it_priveleged_sys_access": "unknown", "comp_cpu_core_count": "2", "comp_u_vandor": "unknown", "comp_subcategory": "Computer", "comp_u_it_os": "unknown", "comp_os_service_pack": "Service Pack 1", "comp_start_date": "unknown", "comp_comments": "unknown", "comp_unverified": "false", "comp_location": "unknown", "comp_justification": "unknown", "comp_cpu_core_thread": "unknown", "comp_sys_tags": "unknown", "comp_sys_mod_count": "7", ClearPass Extension for ServiceNow CMDB - TechNote 22

23 "comp_cost_cc": "USD", "comp_monitor": "false", "comp_u_b_privileged_dbaccess": "unknown", "comp_sys_updated_on": " :01:35", "comp_u_b_workflow": "unknown", "comp_warranty_expiration": "unknown", "comp_invoice_number": "unknown", "comp_fqdn": "unknown", "comp_cost": "unknown", "comp_floppy": "unknown", "comp_ip_address": " ", "comp_u_it_code_deployment": "unknown", "comp_last_discovered": " :01:32", "comp_company": "unknown", "comp_due": "unknown", "comp_chassis_type": "Notebook", "comp_asset_tag": "unknown", "comp_discovery_source": "Service-now", "comp_assignment_group": "unknown", "comp_can_print": "false", "comp_support_group": "unknown", "comp_sys_created_on": " :01:27", "comp_u_b_privileged_sysaccess": "unknown", "comp_hardware_substatus": "unknown", "comp_cost_center": "unknown", "comp_short_description": "unknown", "comp_u_it_app_level_user_role": "unknown", "comp_u_it_config": "unknown", "comp_sys_updated_by": "DannyJump", "comp_name": "BLR-AJAGDISH-41", "comp_form_factor": "unknown", "comp_due_in": "unknown", "comp_u_b_applvl_userrole": "unknown", "comp_install_date": "unknown", "comp_u_it_domain_enterprise_admins": "unknown", "comp_assigned": "unknown", "comp_u_b_os_sys_patch": "unknown", "comp_os_version": " ", "comp_serial_number": "R83XXZH5", "comp_u_b_code_deployment": "unknown", "comp_mac_address": "unknown", "comp_model_number": "unknown", "comp_schedule": "unknown", "comp_ram": "2995", "comp_sys_class_name": "cmdb_ci_computer", "comp_attributes": "unknown", "comp_fault_count": "0", "comp_operational_status": "1", "system_found": "true" ClearPass Extension for ServiceNow CMDB - TechNote 23

24 Appendix B Listing SNOW Custom Fields In Appendix A above is a list of the default fields retrieved by the SNOW extension. To get this data, the extension searches two SNOW Tables (cmdb_ci_computer and cmdb_ci_network_adapter) using the macaddress of the device/endpoint. SNOW, however, supports the concept of custom fields creation. ClearPass is never going to know what these fields are as different customers could/would create different fields with different names. Below is a method than can be used by an advanced network administrator to list the fields within the SNOW CMDB. From this list you can then amend your Enforcement Policy to use the custom field names. The process to list out to these custom fields names: 1. Start by using a known MAC Address within CMDB in colon notation 2. URL-encode the MAC Address by replacing the colons with %3A 3. Use curl (available natively in OS X, or via a 3rd party download for Windows) to query the cmdb_ci_network_adapter table in SNOW curl -X GET -u your_user-id:your_user-id_password -H "Content-Type: application/json" -H "Accept: application/json" " Ac0%3A70" Here is an example of the response: {"result":[{"mac_manufacturer":"","u_b_configdata":"","skip_sync":"false","operational_sta tus":"1","u_b_apps_infrastructure":"","u_it_priveleged_sys_access":"","sys_updated_on":" :01:32","discovery_source":"","first_discovered":"","sys_updated_by":"danny","due_in":"","u_it_priveleged_db_access":"","sys_created_on":" :01:32","sys_domain":{"link":" fig":"","gl_account":"","invoice_number":"","sys_created_by":"danny","warranty_expiration" :"","u_b_privileged_sysaccess":"","asset_tag":"","cmdb_ci":{"link":" enow.com/api/now/table/cmdb_ci/bf e819000d6c2316de754837","value":"bf e d6c2316de754837"},"fqdn":"","u_b_applvl_userrole":"","change_control":"","owned_by":"","c hecked_out":"","u_b_domainenterpriseadmin":"","u_b_workflow":"","u_b_os_sys_patch":"","u_i t_code_deployment":"","dhcp_enabled":"true","delivery_date":"","maintenance_schedule":""," install_status":"1","cost_center":"","supported_by":"","dns_domain":"","name":"[ ] Intel(R) Centrino(R) Advanced- N6200AGN","assigned":"","u_b_privileged_dbaccess":"","purchase_date":"","subcategory":"Net work","short_description":"","assignment_group":"","managed_by":"","can_print":"false","la st_discovered":"","u_b_db_infraoptimization":"","sys_class_name":"cmdb_ci_network_adapter","manufacturer":"","sys_id":"b e819000d6c2316de7548e0","po_number":"","checked_in" :"","netmask":" ","mac_address":"00:27:10:5c:c0:70","u_it_app_infra":"","vendo r":{"link":" Corporation","value":"Intel Corporation"},"alias":"","company":"","justification":"","model_number":"","department":"","u_b_code_deployment":"","assigned_to":"","start_date":"","comments":"","cost":"","sys_mo d_count":"0","u_it_app_level_user_role":"","monitor":"false","serial_number":"","u_it_work flow":"","ip_address":" ","model_id":{"link":" 0061f635db35ea4747"},"sys_tags":"","u_it_domain_enterprise_admins":"","cost_cc":"USD","u_i t_db_infra_and_op":"","order_date":"","schedule":"","support_group":"","due":"","correlati ClearPass Extension for ServiceNow CMDB - TechNote 24

25 on_id":"","unverified":"false","attributes":"","location":"","asset":"","category":"hardwa re","fault_count":"0","u_it_os":"","ip_default_gateway":" ","lease_id":""}]} From the response take, the cmdb_ci value and append it to the query below. The cmdb_ci value used in our example is bf e819000d6c2316de and is highlighted in yellow below. curl -X GET -u your_user-id:your_user-id_password -H "Content-Type: application/json" -H "Accept: application/json" " The output from the above command is shown below: {"result":{"u_b_configdata":"","skip_sync":"false","operational_status":"1","u_b_apps_infr astructure":"","u_it_priveleged_sys_access":"","sys_updated_on":" :01:35","discovery_source":"Service-now","first_discovered":" :01:27","sys_updated_by":"danny","due_in":"","u_it_priveleged_db_access":"","sys_created _on":" :01:27","sys_domain":{"link":" fig":"","gl_account":"","invoice_number":"","sys_created_by":"soapauth","warranty_expirati on":"","u_b_privileged_sysaccess":"","asset_tag":"","fqdn":"","u_b_applvl_userrole":"","ch ange_control":"","owned_by":"","checked_out":"","u_b_domainenterpriseadmin":"","u_b_workfl ow":"","u_b_os_sys_patch":"","u_it_code_deployment":"","delivery_date":"","maintenance_sch edule":"","install_status":"1","cost_center":"","supported_by":"","dns_domain":"","name":" BLR-AJAGDISH- 41","assigned":"","u_b_privileged_dbaccess":"","purchase_date":"","subcategory":"Computer","short_description":"","assignment_group":"","managed_by":"","can_print":"false","last_di scovered":" :01:32","u_b_db_infraoptimization":"","sys_class_name":"cmdb_ci_computer","manufacturer" :{"link":" f635db35ea478f"},"sys_id":"bf e819000d6c2316de754837","po_number":"","checked _in":"","mac_address":"","u_it_app_infra":"","vendor":"","company":"","justification":""," model_number":"","department":{"link":" 924d002b7b19b52aea7174"},"u_b_code_deployment":"","assigned_to":{"link":" ervicenow.com/api/now/table/sys_user/e3aae043b03f6400a4e1c9886ec7c4fc","value":"e3aae043b03f6400 a4e1c9886ec7c4fc"},"start_date":"","comments":"","cost":"","sys_mod_count":"7","u_it_app_l evel_user_role":"","monitor":"false","serial_number":"r83pbh2","u_it_workflow":"","ip_address":" ","mod el_id":{"link":" 4061f635db35ea47f0"},"sys_tags":"","u_it_domain_enterprise_admins":"","cost_cc":"USD","u_i t_db_infra_and_op":"","order_date":"","schedule":"","support_group":"","due":"","correlati on_id":"","unverified":"false","attributes":"","location":"","asset":{"link":" NOW.servicenow.com/api/now/table/alm_asset/ e819000d6c2316de754838","value":" e d6c2316de754838"},"category":"Hardware","fault_count":"0","u_it_os":"","lease_id":""}} Note: Values from the first query (network table) are prefixed with net_ in the extension and everything from the second query will be prefixed with comp_. ClearPass Extension for ServiceNow CMDB - TechNote 25

26 Appendix C Additional Diagnostics and Support Checking on the Extension Service The ClearPass Extensions are supported by a new system service added in 6.6. This service must be running. Note: Restarting this service will affect all deployed and running extensions. To check on the state of the Extension Service, or to restart the service, go to Administration > Server Manager > Server Configuration > [SERVER] > Service Control. By default this service is automatically started. Figure 27: Services Control Extension Logs/Debugging If you have a requirement to access and view the logs from the Extension, you can turn on different logging levels from the API Explorer. It s just a matter of updating a new configuration to ClearPass. For example, the configuration below sets the loglevel to DEBUG. PUT this configuration using the API Explorer as shown below. { "servicenowuri": "your-account.service-now.com", "servicenowuser": "YourUserName", "servicenowpasswd": "YourPassword", "verifysslcerts": true, "loglevel": "DEBUG" } ClearPass Extension for ServiceNow CMDB - TechNote 26

27 Figure 28: Setting debug logging on After the Extension has been configured to capture logs, the process for accessing them is described below. Use the API Explorer to access debug logs from the extension. Figure 29: Getting Logs out of an extension Note: Turning on the timestamps in the logs can be performed by flipping the timestamps option. You can limit the number of logs returned to say the last 100 by specifying a number in the tail parameter. By default all logs are returned with no timestamps. ClearPass Extension for ServiceNow CMDB - TechNote 27

28 Accessing the extension logs using Collect Logs system function In addition to viewing the logs as shown above, logs can also be collected and examined via the Policy Manager Collect Logs system function (Administration > Server Manager > Server Configuration > [Select SERVER] > Collect Logs). This is extremely useful should you have a need to call for technical assistance. If the support team needs to investigate a system issue, one of the items they regularly ask for is the system logs to aid with their diagnostic investigation. By default the loglevel is set to INFO, but TRACE, DEBUG, INFO, WARN, ERROR, FATAL can also be set as required. Any of the levels will display the information for the selected state and lower; if INFO is selected, it will show messages for INFO, WARN, ERROR, FATAL. After the logs have been collected, downloaded and expanded, you can locate the extension logs in the following location in the folder structure PolicyManagerLogs > extension > your-extension-id as shown below. Figure 30: Locating the Extension logs from 'Collect Logs' diagnostic GZ file ClearPass Extension for ServiceNow CMDB - TechNote 28

29 Appendix D Considerations for Installing in a Cluster All previous information in this TechNote applies to a single ClearPass node (publisher-only) deployment. When installing the extension subscriber nodes within a cluster, there are a couple of things that need to be considered. Extension Installation Procedure for a Subscriber When you install an extension on a subscriber, the workflow is a slightly different as there is no process to configure API Clients, generate OAuth2 Access Tokens, etc., as all configuration is performed on the Publisher. To install an extension on a subscriber still requires that you use the API Explorer REST interface to install the extension, and to use the API Explorer requires that you have an OAuth2 Access Token. The problem is that on the subscriber node there is no option to generate the Access Token, as shown below. Figure 31: Subscriber with no "Generate Key" option Note: The solution to the issue is to use the API client on the Publisher to generate an Oauth2 Access Token, then COPY the HTTP Authorization key and use it on the Subscriber. Ensure you copy the Bearer portion of the key. ClearPass Extension for ServiceNow CMDB - TechNote 29

30 Figure 32: Generate API Key in Publisher and copy it After you have copied the OAuth2 Access Token from the Publisher, go directly to the URL on the subscriber. Note: Ensure you enter the Authorization Header in the API Explorer before using trying to use the functions. Figure 33: Entering the HTTP Authorization key into the Subscriber Extension IDs in a Cluster Note that the store-id never changes and is specific to a published version of the extension. The Extension ID refers to the ID of an installed extension on a node. Installing an extension on five subscriber nodes would result in different Extension ID on every node. ClearPass Extension for ServiceNow CMDB - TechNote 30