topic Monitoring ISE node as syslog destination in Network Access Control

Monitoring ISE node as syslog destination

Kashish_Patel — Mon, 11 Mar 2019 02:18:54 GMT

Hi Security Experts,

We are setting up Cisco ISE (Identity Services Engine) in our network.

I have the confusion if we need to configure monitoring node IP address as the syslog destination on the access switches. In what situations is this needed and in which situations is it not needed?

PS: I rate useful posts.

Thanks,

Kashish

Monitoring ISE node as syslog destination

Tarik Admani — Wed, 18 Jul 2012 03:37:55 GMT

Kashish,

When you look at the user authentication report, ISE also builds related syslog messages that pertain to the user connection.

This isnt mandatory but useful since it does help correlate syslog messages to the user authentication session. Here is an example of it in action:

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_troubleshooting.html#wp1050132

Thanks,

Tarik Admani
*Please rate helpful posts*

Monitoring ISE node as syslog destination

Kashish_Patel — Wed, 18 Jul 2012 04:00:46 GMT

Thanks Tarik.

So you mean that even if we don't configure monitoring ISE node IP as syslog destination on access switches, even then ISE gives details of user authentication.

Configuring the IP gives us additional details, right?

Thanks,

Kashish

Monitoring ISE node as syslog destination

Tarik Admani — Wed, 18 Jul 2012 04:22:18 GMT

Exactly, ISE will attached the relevant syslog data (if you have it configured) to the report. The radius authentication will still appear no matter what.

Thanks,

Tarik Admani
*Please rate helpful posts*

Monitoring ISE node as syslog destination

Kashish_Patel — Wed, 18 Jul 2012 04:35:54 GMT

Thanks Tarik. That answers my question.