New_to_ISE: How to See the accounting Messages received from NAS to CIsco ISE in Web interface?

[Chaitanya lohith]

HI All,

I am Trying to figure-out where to see the received Accounting Messages from NAS to ISE go? How do i track them in ISE

[anthonylofreso]

I'm not sure exactly what you're looking for. Is this regarding TACACS accounting? or RADIUS accounting?

In either case, these are my go-to places to audit things...

• Operations > RADIUS > Live Logs
• Operations > TACACS > Live Logs
• Operations > Reports > Device Administration > TACACS Accounting
• Operations > Reports > Audit

You have a lot of options on the Reports page. That's probably the place to go. Live Logs are great for recent events (< 24 HR)

[Chaitanya lohith]

Hi anthonylofreso,

I am looking for RADIUS Accounting. 

For example, if I have accounting packet which is like below NAS to ISE. Then where do i see the below info from CISCO ISE front?

Code: Accounting-Request (4)
Packet identifier: 0x8c (140)
Length: 301
Authenticator: <md5 digest>
[The response to this request is in frame 152019]
Attribute Value Pairs
AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3)
AVP: t=NAS-Identifier(32) l=19 val=e4:f0:04:37:fc:57
AVP: t=NAS-IP-Address(4) l=6 val=10.130.178.162
AVP: t=User-Name(1) l=14 val=000000000012
AVP: t=Called-Station-Id(30) l=19 val=e4:f0:04:37:fc:59
AVP: t=Calling-Station-Id(31) l=19 val=00-00-00-00-00-12
AVP: t=NAS-Port-Type(61) l=6 val=Ethernet(15)
AVP: t=Service-Type(6) l=6 val=Login(1)
AVP: t=Class(25) l=84 val=434143533a30613832623937364b4a4e6d4a7238455a5533...
AVP: t=Acct-Input-Packets(47) l=6 val=0
AVP: t=Acct-Output-Packets(48) l=6 val=11
AVP: t=Acct-Input-Octets(42) l=6 val=0
AVP: t=Acct-Output-Octets(43) l=6 val=1745
AVP: t=Acct-Input-Gigawords(52) l=6 val=0
AVP: t=Acct-Output-Gigawords(53) l=6 val=0
AVP: t=Acct-Authentic(45) l=6 val=RADIUS(1)
AVP: t=Acct-Session-Id(44) l=25 val=000000000012:660000004a
AVP: t=NAS-Port(5) l=6 val=102
AVP: t=Acct-Delay-Time(41) l=6 val=0
AVP: t=NAS-Port-Id(87) l=23 val=Gigabitethernet <port number>

[anthonylofreso]

(Apologies if this is already known...) If you go to the RADIUS Live Logs, and click on the little page under the details column, it should pop a page with a bunch of RADIUS attributes. Although I don't know if it's going to show to the level of detail you have there.

The policy nodes will only get information relevant to their profiling configuration. Which you can change the settings of here:

Administration > System > Deployment > check psn, edit > Profiling Configuration

There is information on appropriate configuration of Policy nodes here: https://community.cisco.com/t5/security-documents/how-to-ise-profiling-design-guide/ta-p/3630914