topic Re: Need help to understand ISE MnT node source of log feeding in Network Access Control

Need help to understand ISE MnT node source of log feeding

rezaalikhani — Thu, 24 Aug 2023 19:43:01 GMT

Hi all;

consider the following figure, captured from "Designing ISE for Scale & High Availability" Cisco Live session in 2018:

As you can see, it mentions that NADs and ASAs can directly send SYSLOG messages to MnT nodes! (as far as I know, MnT nodes can only process SYSLOG messages from PSNs and PANs...)

Can anyone confirm that?

Re: Need help to understand ISE MnT node source of log feeding

Greg Gibbs — Thu, 24 Aug 2023 22:59:57 GMT

Technically the MnT can collect these logs, but it's not best practice to do so.
Sending syslog from the NADs was only ever intended as a temporary solution for troubleshooting. I don't believe the log correlation from the ASA is still a thing.

In general, we would recommend sending syslog from various NADs, Firewalls, and ISE nodes to a SIEM (like Splunk) for correlation and reporting (especially for historical logging)