Basic pxGrid Session Notification Example

This sample registers and outputs messages received for Cisco Identity Services Engine (ISE) session notifications via DXL and Cisco pxGrid.

Prerequisites

• The samples configuration step has been completed (see Samples Configuration).
• The DXL fabric to which the client will connect has been bridged to Cisco pxGrid.
• The Python client has been authorized to receive DXL Cisco pxGrid Notifications (see Authorize Client to Use Cisco pxGrid via DXL).
• Session Notifications from pxGrid have been enabled (see Enable Cisco pxGrid Notifications for DXL).

Running

To run this sample execute the sample/basic/basic_identity_session_notification_example.py script as follows:

python sample/basic/basic_identity_session_notification_example.py

After the example starts up, the initial output should appear similar to the following:

Waiting for session events...

To generate a session notification, create a session for an endpoint on the Cisco Identity Services Engine (ISE) server. If you do not have access to an IEEE 802.1x environment, you can use the Cisco RADIUS Simulator (see the pxGrid ISE testing guide for more details).

For example, you could run the following RADIUS simulator commands in a separate terminal command window to startup a new session for a simulated endpoint:

java -cp RadiusSimulator.jar -DUSERNAME=iseuser -DPASSWORD=isepass -DFRAMED_IP_ADDRESS=192.168.1.1 -DFRAMED_IP_MASK=255.255.255.0 -DCALLING_STATION_ID=00:11:22:33:44:55 -DAUDIT_SESSION_ID=1234 RadiusAuthentication 192.168.1.2
java -cp RadiusSimulator.jar -DUSERNAME=iseuser -DPASSWORD=isepass -DFRAMED_IP_ADDRESS=192.168.1.1 -DFRAMED_IP_MASK=255.255.255.0 -DCALLING_STATION_ID=00:11:22:33:44:55 -DAUDIT_SESSION_ID=1234 RadiusAccountingStart 192.168.1.2

These commands would establish a session for the endpoint 192.168.1.1 on the ISE server 192.168.1.2.

A message similar to the following should appear in the output of the notification example after the session has been started:

{
    "IdentitySourceFirstPort": "0",
    "IdentitySourcePortEnd": "0",
    "IdentitySourcePortStart": "0",
    "MDMEndpoint": {},
    "RADIUSAttrs": [
        {
            "attrName": "Acct-Session-Id",
            "attrValue": "123"
        }
    ],
    "assessedPostureEvent": [
        {}
    ],
    "attribute": [
        {
            "name": "Authorization_Profiles",
            "type": "string",
            "value": "1234"
        }
    ],
    "endpointCheckResult": "none",
    "endpointProfile": "Microsoft-Device",
    "gid": "24703",
    "interface": {
        "deviceAttachPt": {
            "deviceMgmtIntfID": {
                "ipAddress": "192.168.1.1"
            }
        },
        "ipIntfID": [
            {
                "ipAddress": "192.168.1.1"
            }
        ],
        "macAddress": [
            "00:11:22:33:44:55"
        ]
    },
    "lastUpdateTime": "2017-09-21T22:43:38.006Z",
    "providers": [
        "None"
    ],
    "state": "Started",
    "user": {
        "name": "root"
    }
}

You could run the following RADIUS simulator command in a separate terminal command window to disconnect the simulated endpoint's session:

java -cp RadiusSimulator.jar -DUSERNAME=iseuser -DPASSWORD=isepass -DFRAMED_IP_ADDRESS=192.168.1.1 -DFRAMED_IP_MASK=255.255.255.0 -DCALLING_STATION_ID=00:11:22:33:44:55 -DAUDIT_SESSION_ID=1234 RadiusAccountingStop 192.168.1.2

A message similar to the following should appear in the output of the notification example after the session has been disconnected:

{
    "IdentitySourceFirstPort": "0",
    "IdentitySourcePortEnd": "0",
    "IdentitySourcePortStart": "0",
    "MDMEndpoint": {},
    "RADIUSAttrs": [
        {
            "attrName": "Acct-Session-Id",
            "attrValue": "123"
        }
    ],
    "assessedPostureEvent": [
        {}
    ],
    "attribute": [
        {
            "name": "Authorization_Profiles",
            "type": "string",
            "value": "1234"
        }
    ],
    "endpointCheckResult": "none",
    "endpointProfile": "Microsoft-Device",
    "gid": "24703",
    "interface": {
        "deviceAttachPt": {
            "deviceMgmtIntfID": {
                "ipAddress": "192.168.1.1"
            }
        },
        "ipIntfID": [
            {
                "ipAddress": "192.168.1.1"
            }
        ],
        "macAddress": [
            "00:11:22:33:44:55"
        ]
    },
    "lastUpdateTime": "2017-09-21T22:43:44.833Z",
    "providers": [
        "None"
    ],
    "state": "Disconnected",
    "user": {
        "name": "root"
    }
}

Details

The majority of the sample code is shown below:

# Create the client
with DxlClient(config) as dxl_client:

    # Connect to the fabric
    dxl_client.connect()

    logger.info("Connected to DXL fabric.")

    # Create client wrapper
    client = CiscoPxGridClient(dxl_client)

    class MyIdentitySessionCallback(IdentitySessionCallback):
        def on_session(self, session_dict):
            print("on_session\n" +
                  MessageUtils.dict_to_json(session_dict, pretty_print=True))

    # Attach callback for session events
    client.identity.add_session_callback(MyIdentitySessionCallback())

    # Wait forever
    print("Waiting for session events...")
    while True:
        time.sleep(60)

Once a connection is established to the DXL fabric, a dxlciscopxgridclient.client.CiscoPxGridClient instance is created which will be used to communicate with Cisco pxGrid.

Next, the dxlciscopxgridclient.client.IdentityClientCategory.add_session_callback() method is invoked to register a callback for session event notifications.

When a session event occurs, the on_session method in the MyIdentitySessionCallback class is invoked. The session_dict parameter passed into the callback, a dictionary (dict) which contains the content of the event notification, is displayed.