topic Remote logging targets and ISE in Network Access Control

Remote logging targets and ISE

dgaikwad — Wed, 07 Dec 2022 15:04:59 GMT

Hi Experts,

The remote logging targets has been configured and required logging categories are assigned to this remote logging target.
For which ISE node is the syslog port needs to be opened on firewall? Its going to be port UDP/514 for MnT or PAN?
Since, this is a fully distributed deployment need some kind of confirmation on the approach.

Any pointers will be helpful.

Re: Remote logging targets and ISE

balaji.bandi — Wed, 07 Dec 2022 17:21:54 GMT

If you looking to send all logs to syslog, i would add all nodes IP in Firewall to allow syslog port you configured on each device to send logs.

Re: Remote logging targets and ISE

Milos_Jovanovic — Thu, 08 Dec 2022 08:26:49 GMT

Hi @dgaikwad,

You need to allow all ISE nodes to send syslog messages. You can see that in Cisco ISE Port Reference. You can configure port and protocol when defining Remote Logging Target (by default it is UDP/514).

Kind regards,

Milos

Re: Remote logging targets and ISE

dgaikwad — Thu, 15 Dec 2022 10:20:57 GMT

Yes, this configuration makes sense, the ports document shows the same.
As per design all the nodes are sending syslog individually to MnT nodes, thus if the same copy us to be sent to external remote logging target then the ports for all the nodes are to be allowed to syslog server.