ISE Admin Restrictions for RADIUS Logs

[mmshg1234]

Hi ISE Community,

An international customer of ours is using ISE for all their WiFi authentication. Currently, they are managing the worldwide deployment with a central team. They want to spread the workload by giving local admins in different countries (minimum read-only) access to ISE to be able to troubleshoot WiFi issues.

However, for privacy reasons, they do have the requirement that regional admins should only be able to see RADIUS logs for their own region, not globally. Naively, I assumed restricting "Data Access" within the Admin Authorization config would also restrict the admin to see only logs (especially RADIUS Live Logs / Live Sessions) generated by network devices in their region. When trying it out, I noted that this setting really only restricts configuration of Network Devices and their group assignments, the logs themselves are not filtered.

Is there anything in the ISE roadmap or in the latest versions (we're currently on 2.3) to address this? Does anyone have any suggestions how to address the requirement at this point?

Best regards,

Matthias

[Arne Bier · Accepted solution]

Hi @mmshg1234 

You're thinking of something like Cisco Prime Infrastructure's virtual domains which allows regional assignment of devices etc. - ISE doesn't have anything like this.  The RBAC functionality is pretty good for restricting the menu structures. But I have had little joy with the data restrictions, since they pertain to the access mode (read/write, read-only, none) rather than having any scope mechanism.

I would recommend putting a feature request in here

https://www.ciscofeedback.vovici.com/se.ashx?s=6A5348A7707FD7A6

cheers

Arne

[mmshg1234]

Hi Arne,

sorry for my late reply and thank you for the quick and helpful answer. Even if it's not the one I was hoping for :/

Will certainly put in the feature request..