topic Re: Why do we see different MAC address format from ISE in Network Access Control

Why do we see different MAC address format from ISE

samarthashetty — Thu, 28 Oct 2021 14:19:22 GMT

Hi team,

We are seeing a strange issue where logs from ISE are showing different MAC address format in Splunk. If we notice the logs on splunk we see few machines are with xx-xx-xx-xx format however few are xx:xx:xx:xx format. Could any let me know why is this?

regards

Sam

Re: Why do we see different MAC address format from ISE

Mike.Cifelli — Thu, 28 Oct 2021 17:12:57 GMT

This format is an indicator of the Radius attribute 31 known as the Calling-Station-ID. In ISE radius live logs you can see this in action. This attribute is seen/used in Access-Request packets during onboarding. Note that you can also reference this in certain policies within ISE as a condition. HTH!

Re: Why do we see different MAC address format from ISE

samarthashetty — Thu, 28 Oct 2021 17:48:10 GMT

Hi Mike,

thank you for information. SO you mean to say calling station ID mac address format in syslog will be xx-xx-xx-xx. Please correct me if i am wrong. thanks!

Regards

Sam

Re: Why do we see different MAC address format from ISE

thomas — Tue, 02 Nov 2021 19:47:50 GMT

It is possible that different logs output MAC addresses with different delimiters: - or : or nothing at all.

What is the real issue?

Re: Why do we see different MAC address format from ISE

hslai — Tue, 09 Nov 2021 03:05:01 GMT

The NAD might have an option to send a specific format. For example, in IOS-XE,

radius-server attribute 31 mac format ietf upper-case

Re: Why do we see different MAC address format from ISE

samarthashetty — Thu, 11 Nov 2021 14:40:59 GMT

Hi thomas.. I understand that we may see the MAC address with different format across. All we need is to have uniformity across ISE logging where we can. Please let me know how can we achieve this.

Regards

Samarth

Re: Why do we see different MAC address format from ISE

thomas — Wed, 01 Dec 2021 00:16:56 GMT

ISE can take in MAC addresses of different formats and normalize them.

However, there is no option to uniformly format all MAC addresses in the ISE GUI and and logs to a single, consistent format.

You may submit this as a feature request / enhancement along with your details of the specific logs that you have found that are inconsistent and how it causes problems.

I would think Splunk would easily be able to parse and match MAC addresses with any delimiter.