topic Re: Guest Internet Activity in Network Access Control

Guest Internet Activity

gtilburg — Fri, 08 Dec 2017 13:07:13 GMT

Hi,

Our customer would like to map the guest user identity to their Internet activity. From older threads I understand that this is possible using the "Guest Activity Report", now replaced by the "Guest Master Report".

As I have tried to set it up without success, can you confirm that sending IP + URL logs from an ASA/WSA would be parsed by ISE and displayed in the Guest Master Report?

Secondly, is there any recommended solution for User to Web Activity mapping?

Current options I am looking at are:

- ISE Guest master report (see question above)

- SIEM

Would appreciate any proven solution for this.

Best regards

Gert

Re: Guest Internet Activity

Jason Kunst — Fri, 08 Dec 2017 13:29:40 GMT

There should be an example in the ISE guides, have you looked there?

Yes it’s supported as a poor mans reporting

Please be aware there are some bugs around logging of guests seen here in regards to remember me https://communities.cisco.com/docs/DOC-76415

Recommendation for more robust reporting is SIEM

Re: Guest Internet Activity

gtilburg — Fri, 08 Dec 2017 13:32:04 GMT

Thanks for the quick reply Jason.

Do we have any recommended / proven solutions on how to integrate ISE with a SIEM – particularly on how to correlate the URL info with ISE identity?

Regards

Gert

Re: Guest Internet Activity

Jason Kunst — Fri, 08 Dec 2017 13:44:05 GMT

There is nothing documented on our side, we simply send our syslog to splunk for example and then asa would send to them as well

Up to them to correlate for A guest report

Splunk may have something