Historical IP Assignments for Endpoint/User Device in Cisco ISE

[Gh0$t]

Is it possible in ISE to see what was the IP assigned in the past to a particular endpoint/user device (like what was the IP device get then after some time or re-authentication, which IP is used)?

And how any days of logs we can get from Cisco ISE?

[Arne Bier]

The Operational LiveLogs can take up a certain maximum (as a percentage of the total available disk space) - I think it's around 60% or something - it's in the doco somewhere. So the larger your MNT disk size, the longer the Operational LiveLog retention.

I noticed that the Endpoint Attributes "IPv4 Address" and "IPv6 Address" are missing from the Filtered Operational Reports Output (RADIUS Authentication Reports) - that is where you should have been able to see all this, by filtering on one endpoint. You can't add a Column called IPv4 or IPv6 Address. But you can see the IP addresses of the client when clicking on the Details. But that is very tedious.

I'd say this is an enhancement request to Cisco. I doubt they will fix this, because the emphasis seems to be on self-help these days. ISE 3.3 introduced an ODBC interface into the Operational Database to allow users to pull raw data and then build the queries they need. I have not tried this myself, but I would have preferred something other than SQL/ODBC. ISE has always lacked proper Reporting features - the system defaults are mostly no good to anyone.

[Greg Gibbs]

For that kind of historical logging, you would be better suited to send syslog for the events to a SIEM (like Splunk) and creating dashboards/queries on the data in that system.

[Damien Miller]

A third party profiler like Ordr has this feature built in.

As Greg and Arne pointed out, ISE was never meant to provide this information and likely never will even if feature requested.