Cisco ISE logs to DUO

[latenaite2011]

Good morning,

Just wondering if there is a way for Cisco ISE to send logs to DUO when it times out the multi-factor authentication?  We can see that the authentication is successful on Cisco ISE but it seems to time out on Cisco DUO but we're not able to see why it times out.

[Marcelo Morais]

Hi @latenaite2011 ,

 AFAIK ISE can not send logs to DUO and vice-versa, but it's possible to send the logs to a SIEM.

 Please take a look at:

Can logs be exported from Duo to a SIEM?

Configure Cisco ISE to send logs to Splunk

Hope this helps !!!

[latenaite2011]

Thanks Marcelo for the response.

Make sense and not sure if we will get much since the authentication shows successful on ISE and if we can the logs to a SIEM, we'll get similar logs there.  Just wanted to find out what DUO_proxy is seeing when it times out.

[Milos_Jovanovic]

Hi @latenaite2011,

You should check logs on your Duo Authentication Proxy servers, to undestand what is going on. If Duo AuthProxy is installed on top of Linux server, you should look into '/opt/duoauthproxy/log', and on Windows you should look into 'C:\Program Files\Duo Security Authentication Proxy\log'. You can find relevant document here. On this location you'll find log file which contains all relevant info for authentication.

BR,

Milos