topic ISE Live Authentication log collection in Network Access Control

ISE Live Authentication log collection

yun zhang — Mon, 11 Mar 2019 03:52:39 GMT

Hi guys

can i collect the live authentication log by my syslog server from ISE Because our customer need to check who had authenticated and got

authorized by ise ?

ISE Live Authentication log collection

Anas Naqvi — Mon, 09 Sep 2013 15:58:43 GMT

Hi Yun,

The Live Authentications page provides a tabular account of recent RADIUS authentications, in the order in which they happen.

The last update shown at the bottom of the Live Authentications page shows the date of the server, time, and timezone.

Following are the steps you can follow (on ISE 1.2)

Step 1 Choose Operations > Authentications.

Step 2 Select a time interval from the drop-down list to change the data refresh rate.

Step 3 Click the Refresh icon on the Live Authentications menu bar to manually update the data.

Step 4 Choose an option from the Show drop-down list to change the number of records that appear.

Step 5 Choose an option from the within drop-down list to specify a time interval,

Step 6 Click Add or Remove Columns and choose the options from the drop-down list to change the columns that are shown.

Step 7 Click Show Live Sessions to view live RADIUS sessions. You can use the dynamic Change of Authorization (CoA) feature for the Live Sessions that allows you to dynamically control active RADIUS sessions. You can send reauthenticate or disconnect requests to a Network Access Device (NAD).

Step 8 Click Save at the bottom of the drop-down list to save your modifications.

ISE Live Authentication log collection

jan.nielsen — Mon, 09 Sep 2013 18:31:26 GMT

Anas is right, you can get the info directly from ISE, but if you really need to get the authentication/authorization log sent to your own syslog server, you can do that to.

You add a new syslog server under Administration/Logging/Remote Log targets/Add

And then add the new server to Administration/Logging/Logging Categories/Passed Authentications, but be aware that the syslog messages are not small, they normally are around 4KB per syslog message, as they contain alot of information.

ISE Live Authentication log collection

Muhammad Munir — Fri, 13 Sep 2013 05:02:43 GMT

You can monitor recent RADIUS authentications as they happen from the Live Authentications page.

The page displays the top 10 RADIUS authentications in the last 24 hours. This given section explains the

functions of the Live Authentications page.

Operations > Reports

• Operations > Live Authentications > Filter fields

• Operations > Reports > Catalog > Report filter fields

For more information regarding step by step configuration, please go through this link (at page 943-945):

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_ug.pdf