topic Re: Cisco ISE logs to DUO in Network Access Control

Cisco ISE logs to DUO

latenaite2011 — Fri, 10 Sep 2021 16:49:30 GMT

Good morning,

Just wondering if there is a way for Cisco ISE to send logs to DUO when it times out the multi-factor authentication? We can see that the authentication is successful on Cisco ISE but it seems to time out on Cisco DUO but we're not able to see why it times out.

Re: Cisco ISE logs to DUO

Marcelo Morais — Fri, 10 Sep 2021 20:08:51 GMT

Hi @latenaite2011 ,

AFAIK ISE can not send logs to DUO and vice-versa, but it's possible to send the logs to a SIEM.

Please take a look at:

Can logs be exported from Duo to a SIEM?

Configure Cisco ISE to send logs to Splunk

Hope this helps !!!

Re: Cisco ISE logs to DUO

latenaite2011 — Fri, 10 Sep 2021 20:48:53 GMT

Thanks Marcelo for the response.

Make sense and not sure if we will get much since the authentication shows successful on ISE and if we can the logs to a SIEM, we'll get similar logs there. Just wanted to find out what DUO_proxy is seeing when it times out.

Re: Cisco ISE logs to DUO

Milos_Jovanovic — Sat, 11 Sep 2021 09:59:18 GMT

Hi @latenaite2011,

You should check logs on your Duo Authentication Proxy servers, to undestand what is going on. If Duo AuthProxy is installed on top of Linux server, you should look into '/opt/duoauthproxy/log', and on Windows you should look into 'C:\Program Files\Duo Security Authentication Proxy\log'. You can find relevant document here. On this location you'll find log file which contains all relevant info for authentication.

BR,

Milos