12-08-2017 05:07 AM
Hi,
Our customer would like to map the guest user identity to their Internet activity. From older threads I understand that this is possible using the "Guest Activity Report", now replaced by the "Guest Master Report".
As I have tried to set it up without success, can you confirm that sending IP + URL logs from an ASA/WSA would be parsed by ISE and displayed in the Guest Master Report?
Secondly, is there any recommended solution for User to Web Activity mapping?
Current options I am looking at are:
- ISE Guest master report (see question above)
- SIEM
Would appreciate any proven solution for this.
Best regards
Gert
Solved! Go to Solution.
12-08-2017 05:29 AM
There should be an example in the ISE guides, have you looked there?
Yes it’s supported as a poor mans reporting
Please be aware there are some bugs around logging of guests seen here in regards to remember me https://communities.cisco.com/docs/DOC-76415
Recommendation for more robust reporting is SIEM
12-08-2017 05:29 AM
There should be an example in the ISE guides, have you looked there?
Yes it’s supported as a poor mans reporting
Please be aware there are some bugs around logging of guests seen here in regards to remember me https://communities.cisco.com/docs/DOC-76415
Recommendation for more robust reporting is SIEM
12-08-2017 05:32 AM
Thanks for the quick reply Jason.
Do we have any recommended / proven solutions on how to integrate ISE with a SIEM – particularly on how to correlate the URL info with ISE identity?
Regards
Gert
12-08-2017 05:44 AM
There is nothing documented on our side, we simply send our syslog to splunk for example and then asa would send to them as well
Up to them to correlate for A guest report
Splunk may have something
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide