ISE and ACS feature parity - but what about reporting?

[Arne Bier]

I am delighted that ISE 2.3 has improved the feature parity with ACS but I feel a bit let down in the ISE Reporting department.

The sense I get from reading other forum posts is that is that Cisco want us to use 3rd party tools (like Splunk) to make up for the lack of reporting functions in ISE.

I still maintain an ancient ACS 5.4 system and its reporting functionalities are legendary - we use it every day to help us answer real business challenges (e.g. trending reports are amazing) - it manages to combine the right mix of canned reports with a lot of power to tailor the reporting.  I never thought I'd say this, but I will miss the reporting functionality of ACS 

Is there any chance that ISE will get such functionality ?

[hslai]

I have no ACS 5.4 online but, by looking at ACS 5.8's Auth Trend report, it's similar to auth summary reports added in ISE 2.3.

We need more info on what ACS reporting features are missing in ISE 2.3. ACS 5.4 reports are likely similar to what ISE had in ISE 1.1 and prior.

In case of enhancements, please ask your account team to direct them to our ISE product management team.

[Arne Bier]

It would probably take too much time to list all the differences, but one of the common ACS 5.4 reports that we use is shown below which shows the passed/failed auths for one Service in particular.  What I like about this one is that the X axis actually represents time chronologically. ISE sorts the x-axis based on descending Total value, which makes it hard to spot what a weekly trend actually looks like.  What ISE shows is NOT what I would call a trend!!!

The images may need to be clicked on to see the full resolution.

Don't be freaked out by the high number of failed authentications (that's due to a client hardware bug in the field) - another reason why we are so keen on having good reporting tools

Or this one is pretty standard for ACS

I have not customised any ACS reports but that is a whole other discussion (report generation customisation) - very powerful.

[hslai]

Arne:- Thanks for the feedbacks. However, we do need the details to see what and how they are missing.

Have you tried the Authentication Summary report in ISE 2.3 already? Its first chart does have X-axis showing the chronological date/time. It has

• authentications by day (chart)
• authentications by day and quick links (table)
• authentications by failure reason (table)
• authentications by identity group (table)
• authentications by identity store (table)
• authentications by ISE server (table)
• authentications by allowed protocol (table)
• authentications by device name (table)
• authentications by device type (table)
• authentications by location (table)
• authentications by security group (table)

What's not there in ISE 2.3 is a filter on Access Services.

ISE 2.3 does not have Failure Reason Authentication Summary report as a separate report but we may filter on failure reasons in the authentication summary report while RADIUS and TACACS+ have separate auth summary reports.

[Arne Bier]

My ISE 2.2 deployment shows the same tapered bar graphs (not chronological)

I don't see what these graphs are trying to tell me.  There is no option to make the output appear in chronological order that makes sense - I am not interested in which day had the highest  number of total authentications.

Even the columnar table below the graph cannot be sorted by date.

I am creating some auths in my ISE 2.3 lab but I suspect the result will be the same because there is no override or sort option..

[hslai]

I see what you meant now. I think that is an oversight. I will check with the team and file a bug, if needed.

[hslai · Accepted solution]

CSCvf25957 is an existing bug on ordering issue.

CSCvf95838 is a new bug to track group-by "Policy Sets"