topic Monitor authentication failures in Network Access Control

Monitor authentication failures

Kashish_Patel — Mon, 11 Mar 2019 02:56:14 GMT

We have deployed dot1x in our network. Now we want to keep track of all failed authentications before any user reports a problem.

I am wondering if there is an easy way to look at switch logs and find out any authentication that might have failed...I can look at logs on ISE as well, but not all logs can be seen on ISE, so I want to know if anyone has successfully parsed switch logs to know ANY authentication failure from switch perspective. Basically I want to develop a mechanism that keeps on monitoring switch logs for any dot1x auth fail event and alert me. Alerting should be based on switch logs.

Any ideas are welcome.

Thanks.

Monitor authentication failures

Chris Illsley — Thu, 03 Jan 2013 12:58:00 GMT

Why don;t you syslog them somewhere then use something like Kiwi Syslog to filter the entries youare looking for?

Thanks

Chris

Monitor authentication failures

nspasov — Thu, 03 Jan 2013 16:10:39 GMT

Hello Kashish-

Both the switches and ISE should generate logs that you can use to alert you. Here is an example from both my lab switch and my lab ISE node:

Switch:

*Mar 8 22:41:18.318: %DOT1X-5-FAIL: Authentication failed for client (000c.2986.21a8) on Interface Gi0/5 AuditSessionID 0A01060A000000D228EA5AE3

*Mar 8 22:41:18.318: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000c.2986.21a8) on Interface Gi0/5 AuditSessionID 0A01060A000000D228EA5AE3

*Mar 8 22:41:18.318: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000c.2986.21a8) on Interface Gi0/5 AuditSessionID 0A01060A000000D228EA5AE3

*Mar 8 22:41:18.318: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000c.2986.21a8) on Interface Gi0/5 AuditSessionID 0A01060A000000D228EA5AE3

*Mar 8 22:41:18.318: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (000c.2986.21a8) on Interface Gi0/5 AuditSessionID 0A01060A000000D228EA5AE3

ISE:

I hope this helps!

Thank you for rating!

Re: Monitor authentication failures

Tarik Admani — Thu, 03 Jan 2013 17:31:21 GMT

Kashish,

You should be able to spot check the operations dashboard, or run a radius authentication report and the set the status to failed and then run the report.

Thanks

Sent from Cisco Technical Support iPad App