topic Re: Sending logs to MnT nodes in Network Access Control

Sending logs to MnT nodes

Antonio Macia — Wed, 26 Jun 2019 15:24:24 GMT

Hello,

At some Cisco talk, I've heard that sending WLC, ASA, or switches logs to the MnT is recommended for richer visibility. What are the real benefits of this and what new information can ISE take from these logs? Will not impact on the MnT node performance?

Regards.

Re: Sending logs to MnT nodes

Jason Kunst — Wed, 26 Jun 2019 15:37:32 GMT

Which cisco live?

This is only for troubleshooting purposes. Please see cisco live information for ISE performance and scale at it says it there under the training links for BRKSEC-3432
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-118574828

For long term rich logs look into Cisco DNA Assurance and/or splunk

Re: Sending logs to MnT nodes

Antonio Macia — Thu, 27 Jun 2019 06:53:18 GMT

Thank you Jason,

It was at some partner training. I will skip this for the moment then.

regards.

Re: Sending logs to MnT nodes

Antonio Macia — Thu, 27 Jun 2019 06:53:32 GMT

Thank you Jason,

It was at some partner training. I will skip this for the moment then.

regards.

Re: Sending logs to MnT nodes

Jason Kunst — Thu, 27 Jun 2019 18:21:32 GMT

Can you please share the info with me directly at jakunst@cisco.com

Re: Sending logs to MnT nodes

howon — Sat, 29 Jun 2019 16:06:15 GMT

There is small benefit as admin can see the logs from the switches without having to login to each switch. ISE merges the syslog event from the switch with live log. But this is not recommended beyond the pilot stage of the ISE deployment as it impacts ISE load as well as issues with session tracking. Aside from the switch, if ASA sends web access events to MnT, ISE can correlate guest users with web access events from the ASA for guest access log. If using guest access event correlation, make sure to configure ASA to only send web access event as not to overload the MnT node.