topic Re: Send syslog for each new WMI session (passive id) in Network Access Control

Send syslog for each new WMI session (passive id)

Michal Garcarz — Tue, 04 Sep 2018 19:50:30 GMT

Hello Team,

Could you confirm: is it possible for ISE to send syslog message for every new WMI session discovered passively ?

As far as i see in my Splunk: it's NOT. Passiveid service is just for service (not for dataplane/sessions).

(i have almost all components configured to send syslogs to Splunk).

Please confirm - maybe i am missing something.

ISE not doing any authentication.

Thanks,

Re: Send syslog for each new WMI session (passive id)

kvenkata1 — Tue, 04 Sep 2018 22:09:42 GMT

is your flow similar to the one described in this nicely written Techzone article? If so, the answer is Yes.

https://techzone.cisco.com/t5/Identity-Services-Engine-ISE/Configure-EasyConnect-on-ISE-2-1/ta-p/842096

Do you have access to ISE & did you check the Live logs?

- Krish

Re: Send syslog for each new WMI session (passive id)

Michal Garcarz — Wed, 05 Sep 2018 10:51:49 GMT

Hi Krish,

Thanks for the help.

My use case is different - as mentioned ISE is not doing any authentication - with Easy Connect it does.

So i do assume the answer is: ISE is not able to send syslog for passively discovered mappings/sessions, but only for those for which authentication is done.

Correct ?

Thanks,

Michal

Re: Send syslog for each new WMI session (passive id)

kvenkata1 — Wed, 05 Sep 2018 16:13:14 GMT

If the flow is different from what is documented in the link I sent you, then the answer depends. Can you verify what you see in ISE logs?

- Krish

Re: Send syslog for each new WMI session (passive id)

Michal Garcarz — Thu, 06 Sep 2018 12:58:37 GMT

I see no logs in ISE - as i have mentioned already: ISE is not doing ANY authentication 😉

Thanks,

Re: Send syslog for each new WMI session (passive id)

kvenkata1 — Thu, 06 Sep 2018 15:23:05 GMT

In that case no Syslogs may be available. Needs to be a new feature & please connect with the ISE PM team.