topic Re: Disclose invalid username on ISE 2.4p3 in Network Access Control

Disclose invalid username on ISE 2.4p3

Ping Zhou — Thu, 27 Sep 2018 14:17:55 GMT

Hello experts,

ISE 2.4p3 masks the unknow usernames (unknown to all its identity stores) in its live log with "INVALID". I use "Administration >> Settings >> Protocols >> RADIUS >> Disclose invalid username" checkbox to display the unknowns. It lasts for 30 mins then turns off and seems there no way to adjust the duration. Can this be configured for permant on ISE 2.4p3? Thanks!

Re: Disclose invalid username on ISE 2.4p3

Jason Kunst — Thu, 27 Sep 2018 14:22:41 GMT

If there is no setting for it then it’s a feature request

Please reach out thru sales team to product management with your use case

Re: Disclose invalid username on ISE 2.4p3

Damien Miller — Thu, 27 Sep 2018 16:40:34 GMT

I submitted an enhancement request for this on Aug 11th, Cisco Internal reference# F37407. It's not so much an enhancement request as it is the option for restoring earlier behavior.

Re: Disclose invalid username on ISE 2.4p3

Jason Kunst — Thu, 27 Sep 2018 17:30:45 GMT

If it worked before then escalate thru the TAC as a regression. Also work with product managers if getting any resistance and see how they can help

Re: Disclose invalid username on ISE 2.4p3

howon — Thu, 27 Sep 2018 18:07:09 GMT

Enhancement to permanently disclose username or change duration (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh91118) is planned with next version of ISE. We have started accepting beta registration for 2.5 if you are interested:

https://community.cisco.com/t5/network-architecture-blogs/ise-2-5-beta-registration-is-open/ba-p/3711445

Re: Disclose invalid username on ISE 2.4p3

cnorborg — Thu, 14 Jul 2022 21:17:11 GMT

Was this ever done? I'm on a 3.X version and am seeing this in my logs during my initial configuration. Going to Administration - System - Settings - Protocols - RADIUS, I don't see an option for this?

Of course I am trying with TACACS and don't see a "protocol" for tacacs specifically?

Re: Disclose invalid username on ISE 2.4p3

Greg Gibbs — Thu, 14 Jul 2022 21:59:06 GMT

As per the Admin Guide, the 'Disclose Invalid Usernames' option is available in the Administration > System > Settings > Security Settings page.

Re: Disclose invalid username on ISE 2.4p3

Marcelo Morais — Thu, 14 Jul 2022 23:29:58 GMT

Hi @cnorborg ,

!version 2.4

In Administration > System > Settings > Protocols > RADIUS > Suppression & Reports > Authentication Details > Disclose invalid usernames

!version 2.6+

In Administration > System > Settings > Security Settings > Disclose invalid usernames

About " ... and don't see a "protocol" for tacacs specifically ... ", there is "no protocol" for TACACS+.

Hope this helps !!!

Re: Disclose invalid username on ISE 2.4p3

Paolo Di Filippa — Mon, 14 Nov 2022 14:04:08 GMT

Does anyone knows if permanently activating this option will affect global performances of the deployment? I didn't find anything about this topic on the Net...Thanks in advance for your feedbacks

Re: Disclose invalid username on ISE 2.4p3

Greg Gibbs — Mon, 14 Nov 2022 23:01:35 GMT

There should be no performance impact by having the option enabled. The feature was added to improve security, not to improve performance.