topic Re: Report based on TLS version used by endpoints in Network Access Control

Report based on TLS version used by endpoints

dgaikwad — Mon, 09 Mar 2020 09:16:14 GMT

Hello Experts,
I would like to extract reports based on the TLS version being used by the endpoints, as seen here:

But, was not able to locate such a filter on ISE Reporting, any pointers to the same?
Or is this something that cannot be extracted from ISE?

Re: Report based on TLS version used by endpoints

Mike.Cifelli — Mon, 09 Mar 2020 13:51:27 GMT

AKAIK there is not a direct report you can run to target that. However, you could run a report on Top N Authentication by Failure Reason, and create a rule like this: Failure reason contains TLS. This would report how many endpoints are failing auth due to TLS issues. Do you use the ise posture module? If so, you could setup a registry check to determine what your hosts are configured to use from a Windows perspective: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\PPP\EAP\13. That key is specifically applicable to EAP TLS and PEAP. There may be some other keys you could leverage as well. Good luck & HTH!

Re: Report based on TLS version used by endpoints

dgaikwad — Thu, 12 Mar 2020 06:11:26 GMT

Yes, I did try out this way of finding out the endpoints, but this method does not provide an option to extact the report in csv format.
The report generated in graphical format only...

Any workaround to get that report extracted in csv format?