cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
436
Views
5
Helpful
8
Replies

ISE(TACACS) log categories to send NADs audit trail to remote targets

Hi Guys
unsuccessfully have been searching through docs to discover.
Can it be Accounting / TACACS Accounting or ...?

Any help please

1 Accepted Solution

Accepted Solutions

@andy!doesnt!like!uucp:  Yes, you are correct but you do not need AAA Diagnostics / TACACS Diagnostics.  What you do is to create a new syslog collector and add add under the Accounting remote target.  One other thing, make sure you change that syslog collector size limit to 8192 to avoid your AAA accounting log being cutoff.  

 

HTH.

View solution in original post

8 Replies 8

adamscottmaster2013
Participant
Participant

@andy!doesnt!like!uucp:  can you elaborate exactly what you're trying to do so that I might be able to help you?

Hi Adam
DNAC-managed devices are configured with below aaa (meaning whatever network admin activity on the switch happens it gets sent to TACACS)
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
Now, in the ISE, we want all this events to be sent to remote SYSLOG-server.
What would be appropriate ISE logging category to address this topic?
Within my assumptions r :
AAA Diagnostics / TACACS Diagnostics
Accounting / TACACS Accounting

Can u confirm? Does it fully address requirement?

 

@andy!doesnt!like!uucp:  Yes, you are correct but you do not need AAA Diagnostics / TACACS Diagnostics.  What you do is to create a new syslog collector and add add under the Accounting remote target.  One other thing, make sure you change that syslog collector size limit to 8192 to avoid your AAA accounting log being cutoff.  

 

HTH.

Hi Adam
thanks for input. could you please bring more details on collector size (Maximum Length, right?) limit as it seems to be smaller atm 

andydoesntlikeuucp_0-1701879464678.png

 

@andy!doesnt!like!uucp:  The default value of 1024 might not be enough for some of the AAA accounting message because some of them might get truncated.  Maximum length 8192 should be used whenever possible.

does it mean that TACACS's syslog agent truncates message on its level of operation? bc we have TCP syslog which must manage this stuff with TCP MSS payload adjustment on the transport layer.

@andy!doesnt!like!uucp:  you might not to worry about if you use TCP syslog but I am not so sure about this.  I only use udp syslog and that's what I observed.

good to know it's not n application layer defect as well as good syslog implementation could be reliable even with udp :0)   

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: