cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

538
Views
0
Helpful
3
Replies
gtilburg
Cisco Employee

Guest Internet Activity

Hi,

Our customer would like to map the guest user identity to their Internet activity. From older threads I understand that this is possible using the "Guest Activity Report", now replaced by the "Guest Master Report".

As I have tried to set it up without success, can you confirm that sending IP + URL logs from an ASA/WSA would be parsed by ISE and displayed in the Guest Master Report?

Secondly, is there any recommended solution for User to Web Activity mapping?

Current options I am looking at are:

- ISE Guest master report (see question above)

- SIEM

Would appreciate any proven solution for this.

Best regards

Gert

1 ACCEPTED SOLUTION

Accepted Solutions
Jason Kunst
Cisco Employee

There should be an example in the ISE guides, have you looked there?

Yes it’s supported as a poor mans reporting

Please be aware there are some bugs around logging of guests seen here in regards to remember me https://communities.cisco.com/docs/DOC-76415

Recommendation for more robust reporting is SIEM

View solution in original post

3 REPLIES 3
Jason Kunst
Cisco Employee

There should be an example in the ISE guides, have you looked there?

Yes it’s supported as a poor mans reporting

Please be aware there are some bugs around logging of guests seen here in regards to remember me https://communities.cisco.com/docs/DOC-76415

Recommendation for more robust reporting is SIEM

View solution in original post

Thanks for the quick reply Jason.

Do we have any recommended / proven solutions on how to integrate ISE with a SIEM – particularly on how to correlate the URL info with ISE identity?

Regards

Gert

There is nothing documented on our side, we simply send our syslog to splunk for example and then asa would send to them as well

Up to them to correlate for A guest report

Splunk may have something

Content for Community-Ad