Solved: Need help to understand ISE MnT node source of log feeding

rezaalikhani · ‎08-24-2023

Hi all;

consider the following figure, captured from "Designing ISE for Scale & High Availability" Cisco Live session in 2018:

As you can see, it mentions that NADs and ASAs can directly send SYSLOG messages to MnT nodes! (as far as I know, MnT nodes can only process SYSLOG messages from PSNs and PANs...)

Can anyone confirm that?

Greg Gibbs · ‎08-24-2023

Technically the MnT can collect these logs, but it's not best practice to do so.
Sending syslog from the NADs was only ever intended as a temporary solution for troubleshooting. I don't believe the log correlation from the ASA is still a thing.

In general, we would recommend sending syslog from various NADs, Firewalls, and ISE nodes to a SIEM (like Splunk) for correlation and reporting (especially for historical logging)

View solution in original post

Greg Gibbs · ‎08-24-2023

Technically the MnT can collect these logs, but it's not best practice to do so.
Sending syslog from the NADs was only ever intended as a temporary solution for troubleshooting. I don't believe the log correlation from the ASA is still a thing.

In general, we would recommend sending syslog from various NADs, Firewalls, and ISE nodes to a SIEM (like Splunk) for correlation and reporting (especially for historical logging)