ISE 2.1 and Windows 2012R2 Log collector

[Ptomic]

Hello, dear friends. I need a help with solving one problem. 

We have ISE 2.1, and we implemented Windows Server 2019 Core version as DC's. 

Because 2.1 supports up to WS2012R2 only, we got into a trouble. To solve this problem we implemented WS2012R2 as to represent Log Collector for Security logs from our DC's. 

Now we need to force our ISE to read Logs from our Log Collector and doesn't have any idea how to do that. 

Any help is appreciated. 

Thank you in advance. 

[hslai]

If the log collector is a Domain Controller and a Windows Event Collector (WEC) server you may set the destination to either System or Application. Then, configure ISE to use this server as a WMI provider as in Manage Users and External Identity Sources > Manage the Active Directory Provider

[Ptomic]

Log collector and DC’s are different servers. 
DC’s are Windows Server 2019, and Log Collector is 2012R2, because ISE 2.1 supports up to 2012R2. 
We need a help getting to find solution how to force ISE to get logs from Log Collector. 

[hslai]

Please take time and plan upgrade your ISE deployment. Cisco Identity Services Engine Software Version 2.1 Product Bulletin says, "... ISE 2.1 will reach end of support at March 17^th 2020. ... "

Unfortunately the Active Directory providers in ISE (or ISE PIC) can only be domain controllers. There is also a limit that ISE needs to be in the same site (See CSCvo31822).

I do not see a problem of ISE 2.1 to work with a later Microsoft Windows Server releases, such as 2016 or 2019, although our teams did not test such combinations specifically. The issues might be more around server core option without desktop experience, because we have not tested that, to my knowledge.

If you are really unable to use the active directory providers, then consider other providers. Some of our customers forward the Windows events to some 3rd-party application which in turn forward the events as syslog to ISE. In such case, we configure the 3rd-party as a syslog provider and create a syslog regex template to parse the events.

[Ptomic]

I will install SysLog then.

Can you help me with reqex template and configuring ISE to use this SysLog provider ?