SPAN session for every authenticating domain controller

benugent — Fri, 21 Feb 2020 18:31:52 GMT

With Kerberos SPAN, wouldn’t we have to have a SPAN session for every authenticating domain controller in the environment? Since there can only be two ISE-PIC nodes, that seems to eliminate that option (if my assumption’s correct).

Also, if we were to stand up a member server with the agent on it, does it need to be set up as an Event Log Collector and all the domain controllers configured with Event Log Forwarding to the member server?

Thank you,

Brian Crocker bricrock

Re: Is there anyone watching this space still that could answer Brian's question:

Timothy Abbott — Mon, 13 Feb 2017 15:08:02 GMT

Brian,

You are correct that log forwarding would have to be setup to send logon messages to the member server running the agent. You can do this with group policy. Here is an article on how to do it.

PIC Kerberos SPAN is looking for specific events and I'm pretty sure that is regardless of authenticating domain controller. The only requisites you need to enable Kerberos SPAN is to ensure the PassiveID service is running (which is by default in PIC) and to select the interface you are going to use to monitor for logon events. If we need to discuss further, we can set up a meeting.

Regards,

-Tim

topic SPAN session for every authenticating domain controller in Network Access Control

SPAN session for every authenticating domain controller

Re: Is there anyone watching this space still that could answer Brian's question: