Find Specific logs in ISE for the last 30 days

[kentwirianata]

Hello.
I'm new on ISE, I want to find the logs for the last 30 days for all user that failed to connect to VPN with root cause 'wrong password', also the result of comparission between success and failed authentication that showed in Circle diagram if possible. anyone can guide me?

[balaji.bandi]

Try reports - Operation --> reports and select range of and generate reports.

what version of ISE, 3.X have good features, older one you may struggle but you can get best of it.

[kentwirianata]

Thank you for your reply!!! 

I'm still confuse, where's the filter to find specific value I want like:

Authentication Policy: VPN

Root cause: Wrong password

[ahollifield]

Your MFA solution/IDP would be the best place to view this information.  What is the multi-factor authentication provider in this environment?

[kentwirianata]

I use Microsoft Authentication for MFA

[ahollifield]

How is NPS integrated with ISE?  Token Server?  I would consider checking both the ISE reports section as @balaji.bandi  said and the NPS logs as well.

[ahollifield]

Yeah the Reports section or Log Analytics in ISE 3.2+.  Or external syslog reporting to something like Splunk.

[MHM Cisco World]

Are you use ftd with fmc for vpn ?

MHM