topic Re: Cisco ISE - Remote target logging SIEM in Network Access Control

Cisco ISE - Remote target logging SIEM

iran — Sun, 12 Nov 2023 22:01:16 GMT

Hi,

I need to integrate ISE to send logs to SIEM.
I have a distributed large deployment, one VM for each ISE persona.

My doubt is the following:
1. Which IP address should I configure on SIEM? Only MnT nodes? or all Cisco ISE nodes?

2. Which ISE node will send logs to SIEM?

Re: Cisco ISE - Remote target logging SIEM

Greg Gibbs — Sun, 12 Nov 2023 23:28:28 GMT

When configured with a remote logging target, all ISE nodes will directly send syslog to the external target. The PSNs will send endpoint session-related logs directly to the target and all nodes will send health-related logs directly to the target.

Re: Cisco ISE - Remote target logging SIEM

iran — Mon, 13 Nov 2023 15:10:05 GMT

Hello, Thank you.

I am still with doubts about which IP addresses should I add on SIEM server configuration and allow firewall rules.

My initial understanding was that there is only need to add MnT IP addresses on SIEM configuration. Please, let me know if this is not correct.

Since all the logs are sent to MnT, I am assuming that MnT has the needed information to send to the SIEM

Re: Cisco ISE - Remote target logging SIEM

adamscottmaster2013 — Mon, 13 Nov 2023 16:25:02 GMT

I use splunk as remoting logging target and configure all ISE nodes to communicate with splunk SIEM.

Re: Cisco ISE - Remote target logging SIEM

Aref Alsouqi — Mon, 13 Nov 2023 17:12:15 GMT

That is the case unless you configure an external logging target. When you configure the external logging target all ISE nodes that would have generated and sent the logs to the MnT will start sending their logs to the external logging target.

Re: Cisco ISE - Remote target logging SIEM

Greg Gibbs — Mon, 13 Nov 2023 21:10:31 GMT

@iran ... to be very clear, the MnT nodes DO NOT 'roll-up' logs sent from the other nodes and send them to the external syslog/SIEM server. As I stated before, all nodes will source their relevant syslog messages directly to the external target.