topic Re: Are you impacted? - ISE syslog double backslash in Network Access Control

Are you impacted? - ISE syslog double backslash

DB101 — Fri, 21 Feb 2020 19:01:06 GMT

We need your help to convince Cisco to resolve a defect. Please get on-board!

We are trying to integrate UserID function between Cisco ISE 2.x and Palo Alto Networks Firewalls. A Cisco ISE defect is causing a double backslash between domain and userID in the syslog output

We need you to add your company to the defect listed below so Cisco knows that multiple people are (or will be) impacted.

Cisco have now acknowledged this defect but are refusing to prioritize a fix. Cisco allege we are the only organization impacted. If multiple people are impacted Cisco will provide a fix.

Please let Cisco know you are impacted and help us pressure Cisco to provide a fix.

Defect Details

CSCvk09565 ISE 2.x onwards RFC 3164 is not being followed completely

Symptom

Syslog messages are sent with double slash in the username field.

Characters which are escaped with double slash are ,;{}\

Conditions

ISE 2.x version

Workaround

None

Further Problem Description

Below characters are escaped as of now

,;{}\

No Character should be escaped as per RFC 3164 which ISE follows.

Re: Are you impacted? - ISE syslog double backslash

Arne Bier — Wed, 18 Jul 2018 01:35:37 GMT

Thanks for alerting us about this. I just had a look in my Splunk dashboard and I see what you're talking about. Luckily for us we're not looking closely enough to the SYSLOGS (yet) but one day in the future this may become a concern. I would chime in, but it's not causing us any issues so far (touch wood) - I am also tracking a bunch of bug ID's with our Cisco SE/AM that are causing us issues.

Good luck with your campaign!

Re: Are you impacted? - ISE syslog double backslash

DB101 — Wed, 18 Jul 2018 01:40:07 GMT

Can you please let Cisco know you can see this defect in your environment are impacted. This will help us convince Cisco to provide a solution.

Re: Are you impacted? - ISE syslog double backslash

Arne Bier — Wed, 18 Jul 2018 01:59:44 GMT

Hi DB101

how does this communication to Cisco happen exactly? I can't open a TAC case because I cannot justify it. Is there an email address I should use?

Re: Are you impacted? - ISE syslog double backslash

DB101 — Wed, 18 Jul 2018 03:10:41 GMT

I think a TAC case if the official way to do it.

If you can't raise a TAC case, just reply to this thread. I can see it is now linked to the bug.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk09565

Re: Are you impacted? - ISE syslog double backslash

wamanbhalerao — Wed, 18 Jul 2018 04:25:22 GMT

We are not able to Integrate Cisco ISE and Palo alto User agent server for User ID and IP mappings hence not able to use the User ID feature

Re: Are you impacted? - ISE syslog double backslash

Krups — Wed, 18 Jul 2018 05:54:21 GMT

Hi,

I am impacted too with this problem for months. It could be really great to solve this issue, we will then be able to manage also our customer centers.

Sylvain

Re: Are you impacted? - ISE syslog double backslash

ajc — Wed, 18 Jul 2018 21:57:33 GMT

Let me take a look on the logs. I was not aware of it.

Re: Are you impacted? - ISE syslog double backslash

craiglebutt — Fri, 10 Aug 2018 09:41:39 GMT

Query, were you able to see any logs coming to the PA from ISE in cli?

I've logged a call with PA, see what they come up with

Re: Are you impacted? - ISE syslog double backslash

DB101 — Wed, 21 Nov 2018 22:27:14 GMT

We received a patch from Cisco that addresses this issue and results in a single backslash. Suggest you contact Cisco and request the patch. I believe it will be incorporated in a future release.

Re: Are you impacted? - ISE syslog double backslash

craig.moore — Mon, 07 Jan 2019 16:18:48 GMT

Do you have information regarding the patch? I've opened a case with Cisco and the information they're giving me is "Unfortunatley, there is not hotpatch and it doesn't seem that one will be release.It could be that they fix it in new patch for newer versions but at the moment we just have the infromation that it would be fixed in 2.6."

Re: Are you impacted? - ISE syslog double backslash

Jason Kunst — Mon, 07 Jan 2019 19:15:13 GMT

Suggest you try escalating through TAC to ask for a fix if possible

Re: Are you impacted? - ISE syslog double backslash

craiglebutt — Tue, 08 Jan 2019 08:03:31 GMT

Have you still got the issue? I'm on 2.4, by the sound of it had the same issue.

Was trying to get this sorted for ages.

Issue was trying to find the correct UserName for us, screen grab attached.

This was sorted by Palo Alto support company

Re: Are you impacted? - ISE syslog double backslash

Krups — Mon, 22 Feb 2021 11:10:22 GMT

The problem is still there in 2.7

Anyone has found a solution?

Thanks

Re: Are you impacted? - ISE syslog double backslash

Marcelo Morais — Mon, 22 Feb 2021 12:03:41 GMT

Hi @Krups ,

I double check the CSCvk09565 bug:

Last Modified: Feb 15, 2021
Status: Fixed
Known Fixed Release: 2.6(0.156)

Please take a look at: ISE 2.6 Release Notes.

Hope this helps !!!

Re: Are you impacted? - ISE syslog double backslash

Krups — Mon, 22 Feb 2021 14:20:56 GMT

Yes you are right it is written in the release note but I think it is not solved.

I just did a capture of the UDP traffic after an authentication on the ISE portal and I have "\\" between the domain and the username for UserName= and GuestUserName=

Re: Are you impacted? - ISE syslog double backslash

Marcelo Morais — Mon, 22 Feb 2021 14:33:53 GMT

Hi @Krups

please open a TAC case for that, if it was fixed in version 2.6 it should have been fixed in version 2.7 P2 !!!

Best regards.

Re: Are you impacted? - ISE syslog double backslash

Stove Jons — Fri, 10 Jan 2025 16:41:09 GMT

This appears to be an issue again on ISE version 3.3 patch 4.

Logs are still coming across as User-Name=Domain\\username

Looking through many threads on this community site from 2018-2021, this issue is reported as being fixed in ISE 2.6 and beyond but that does not appear to be the case as all of our syslog coming from ISE shows the double slash.

Re: Are you impacted? - ISE syslog double backslash

Marcelo Morais — Fri, 10 Jan 2025 18:30:27 GMT

Hi @Stove Jons ,

please open a TAC Case and report the Bug ID: CSCvk09565 ISE 2.x onwards RFC 3164 is not being followed completely.

Best regards.

Re: Are you impacted? - ISE syslog double backslash

ajc — Fri, 10 Jan 2025 19:50:57 GMT

I am running ISE 3.3 but have not installed patch 4. I will post my findings.