topic Re: ISE Authentication Certificate Audit in Network Access Control

ISE Authentication Certificate Audit

jcresdee — Mon, 21 May 2018 18:15:40 GMT

My customer is looking to perform an audit on which certificates are being used by which endpoint for authentication. They are trying to deprecate an old certificate and would like to understand which devices are still actively using it for authentication. They are using an external CA and not using ISE as a CA. Is there a way of capturing that data in a report? If not, can we raise it as a feature request?

Re: ISE Authentication Certificate Audit

hslai — Mon, 21 May 2018 18:58:51 GMT

AFAIK we have no summary reports on such.

In auth detail reports, there is field TLSCipher; e.g.

TLSCipher

ECDHE-RSA-AES256-SHA

If that is what the customer can use for this, then either get it from individual auth detail reports or use a remote syslog target to capture it.

If you would like it as an enhancement, please contact our product management team.

Re: ISE Authentication Certificate Audit

jcresdee — Tue, 22 May 2018 14:04:56 GMT

Would you be able to tell me how I would extract the information via Syslog?

Re: ISE Authentication Certificate Audit

hslai — Wed, 23 May 2018 22:36:42 GMT

Define a remote syslog target
Enable auth success to (1)
Test

Video Link : 17053

Re: ISE Authentication Certificate Audit

jcresdee — Thu, 24 May 2018 20:14:07 GMT

That is awesome, thank you so much!!