topic Tacacs accounting from cisco ISE report for Palo alto Firewall, F5 devices, Windows server. in Network Access Control

Tacacs accounting from cisco ISE report for Palo alto Firewall, F5 devices, Windows server.

kaushalparab — Mon, 03 May 2021 04:58:23 GMT

Hi,

i have few admins users who do authenticate with tacacs on Cisco ISE. i want to monitor all the commands they issued on devices and which devices they access for audit purposes. i can able to get the reports from cisco switches for which users access what devices and executed which commands but i don't get the details of which commands the user executed and which device they access in cisco ISE for F5 LB , palo alto firewall, windows server, etc. can anyone help? thanks.

Re: Tacacs accounting from cisco ISE report for Palo alto Firewall, F5

QusaiBashir — Thu, 09 Jun 2022 12:30:05 GMT

Hallo sir,

could you please share if you got an answer cuz i am facing the same issue.

best regards

Re: Tacacs accounting from cisco ISE report for Palo alto Firewall, F5

Cgoldman1 — Wed, 17 Apr 2024 15:04:20 GMT

Does anybody have a Network Device Profile for Palo Alto in ISE?

Our PA devices are authenticating fine w/ ISE via TACACS, however, network device profile = Cisco which drives me nuts. I cannot find any documentation on how to build a NDP in ISE for Palo Alto.

Regards!

Re: Tacacs accounting from cisco ISE report for Palo alto Firewall, F5

Aref Alsouqi — Wed, 17 Apr 2024 15:15:16 GMT

Go to Policy > Policy Elements > Dictionaries > Radius > RADIUS Vendors and add a new dictionary, you can call it Palo Alto and set the vendor ID to be 25461, and then create a new network device profile and associate the RADIUS dictionary attribute you created.

Re: Tacacs accounting from cisco ISE report for Palo alto Firewall, F5

adamscottmaster2013 — Wed, 17 Apr 2024 16:24:04 GMT

"but i don't get the details of which commands the user executed and which device they access in cisco ISE for F5 LB , palo alto firewall, windows server, etc."

There are limitations on what you can do with "non" Cisco devices like Palo Alto or F5 devices. The best thing to do is to send PAN or F5 audit logs via syslog to either ElasticSearch or Splunk and you can find them there. Much easier to do than using Cisco ISE.

My 2c.