topic Re: cisco ise 2.4 command auth report question in Network Access Control

cisco ise 2.4 command auth report question

baker82 — Thu, 13 Jun 2019 01:48:35 GMT

hello,

i would like to know if Cisco ISE can send live reporting of all command auths on the devices that is being managed with ISE.

I have attempted to use the Admin > Settings > Alarm Settings > Alarm Notifications but im not sure which alarm would provide this tacacs-command auth.

I was able to use the reporting feature to send these to my local repository but I am needing the report to be detailed via email.

thanks in advance 🙂

Re: cisco ise 2.4 command auth report question

Arne Bier — Thu, 13 Jun 2019 06:15:00 GMT

By design, if you use TACACS+ for device admin, then the TACACS+ Accounting can contain the commands that are executed. It would be one accounting record per command authorized. You can also see that in the SYSLOGs. Not sure if you want this kind of data sent to you as individual emails (if I understood your initial comments).

If you choose to use Radius for device admin, then you don't get the command accounting. You will get Radius Accounting that contains bytes in/out, but not the commands itself. TACACS is the way forward!

Re: cisco ise 2.4 command auth report question

Mohammed al Baqari — Thu, 13 Jun 2019 07:43:06 GMT

You can't generate an alarm for command change in ISE. You can do this from
syslog server by generating an alarm if syslog message matched.

Re: cisco ise 2.4 command auth report question

ldanny — Thu, 13 Jun 2019 11:12:16 GMT

ISE will send a notification email when report is complete but not the detailed report itself.

I suggest contacting the sales team for feature enhancement or provide feedback option within ISE GUI (Click on the gear icon in the upper right corner).

You could try using FTP/SFTP to schedule transfers from repository to email.

Re: cisco ise 2.4 command auth report question

baker82 — Thu, 13 Jun 2019 13:48:35 GMT

thank you for all the help.

Ill see if i can automate this with a script to pull from repository, convert to text file, then send email. I was really hoping to have a real-time report sent via email but im thinking this might meet the teams requirements.

Michael