topic Re: ISE / Stealtwatch treat mitigation doesnt work in Network Access Control

ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Thu, 10 Aug 2017 10:56:01 GMT

hi,

my ise and stealthwatch are connected via pxgrid. i followed every step of the " Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)" Guide from John Eppich and used the ISE internal CA.

My ISE and Stealthwatch are connected as you can see in the screenshots right here:

thanks in advance!

Re: ISE / Stealtwatch treat mitigation doesnt work

jeppich — Thu, 10 Aug 2017 14:36:41 GMT

Hey Andreas,

Do you have the aaa server radius dynamic author command configured on your switch?

Thanks,

John

jeppich@cisco.com

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Thu, 10 Aug 2017 14:53:43 GMT

Hi John,

thanks for you reply!

Yes, its activated, just doublechecked it

Another point which I am worried about is, I don’t see a IP adress of the host in the live log:

--> see attached image

Would it be helpful for you, if a attach the switch configs?

Thanks in advance and regards,

Andreas

Re: ISE / Stealtwatch treat mitigation doesnt work

jeppich — Thu, 10 Aug 2017 15:57:07 GMT

Hey Andreas,

This is most likely a switch configuration issue, please refer to: https://developer.cisco.com/fileMedia/download/63e057cc-beb1-4f66-9836-68d3391f7f0a

Look "Under "802.1X (optional)", you should see the required commands for the switch. Please check to see if you have these configured on your switch. More specifically, dhcp snooping, and ip device tracking should be turned on, and you have radius accounting updates configured.

We can also setup a webex, if this still is not working.

Thanks,

John

jeppich@cisco.com

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Thu, 10 Aug 2017 17:24:47 GMT

i will check this tomorrow when i am back at the office!

thank you very much for all the effort john!

will get back to you asap!!

Re: ISE / Stealtwatch treat mitigation doesnt work

paul — Thu, 10 Aug 2017 19:24:39 GMT

I don't believe you need DHCP snooping although it is a security best practice we roll out with ISE typically. IP device tracking should give you the IP information of the attaching host.

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Fri, 11 Aug 2017 11:38:59 GMT

hi guys,

we made a step into the right direction - for now i can see the username and the ip adress, as you can see here:

BUT if i try to put a host in quarantine it says the smc is not connected to the ise, but "obviously" it is:

Thanks and regards,

Andreas

Re: ISE / Stealtwatch treat mitigation doesnt work

jeppich — Fri, 11 Aug 2017 15:34:18 GMT

Hey Andreas,

Let's schedule a webex. Email me directly to schedule a webex for next week. Let me know what days and times work best for you.

Thanks,

John

jeppich@cisco.com

Re: ISE / Stealtwatch treat mitigation doesnt work

hslai — Sat, 12 Aug 2017 01:26:40 GMT

As mentioned in Re: Stealthwatch EPS Integration, the setup has ISE 2.2 Patch 1, which has CSCvc81676, so I suggested to apply Patch 2.

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Mon, 14 Aug 2017 08:45:29 GMT

i installed patch 2 this morning, but i still can not find any information about the CSCvc81676 - as i already mentioned before..what is that bug about?

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Mon, 14 Aug 2017 08:45:43 GMT

done

Re: ISE / Stealtwatch treat mitigation doesnt work

hslai — Mon, 14 Aug 2017 14:55:29 GMT

Did applying patch 2 resolve the issue? The bug is on this issue exactly.

Re: ISE / Stealtwatch treat mitigation doesnt work

AndiBuchmann157 — Mon, 14 Aug 2017 14:57:58 GMT

nope it is not. can you provide me any link where i can find more info about that?

i think it is still a little configuration issue, waiting for John's answer atm to schedule a Webex with him