Hello, this is for folks who are familiar with ACAS but any feedback would be appreciated.
We currently are using ISE 2.4.
We have been successfully authenticating our network edge devices for sometime.
We are event able to utilize PKI for edge access so no username/passwords are required except for emergent access.
The ACAS team runs their scans of the network but we don't see it access all the devices when viewing ISE TACACS Live Logs.
We can see it hit say the core, a distribution switch and some edges but it doesn't access other devices in the same IP subnet range. So when we view the running live log we see nice green checks for switch 1, switch 2, switch 4, and switch 6 but switches 3 and 5 don't appear as successful or failed attempts. Viewing the local log on switch 3 and 5 says that the account used to do the scans successfully accessed the device.
If I login to the same device, switches 3 and 5 with the same credential using SecureCRT or putty I gain access and I'm at the proper privilege level.
I did an extensive Wireshark capture using but monitor session # filter vlan #### , #### and monitor session # source vlan ### , ####.
I got tons of traffic and the successful ISE authentications were there; however, I didn't see any traffic for the devices that didn't go through ISE for AAA.
The ACAS is scanning a /8 range for the subnet, in our view this is way to broad but it's not our server.
We have the subnets broken up into a couple of /27's and /24's.
Any ideas on where to start sleuthing?
ej
