Question ISE logs

[cisco.13]

Hello Everybody,

Can you please tell me what the ISE/TACACS logs of my ASA device correspond to?
indeed, the "Username" is configured on both device (local username).

- Who initiates these requests?
- What is the "Username" used (that of ISE or ASA)?
- What are these requests for?
- Is there an impact if I delete the Username from ISE?

Example 1:
13013 Received TACACS+ Authentication START Request - AD
....
13015 Returned TACACS+ Authentication Reply

Request Type Authentication
Status Pass
Message Text Passed-Authentication: Authentication succeeded
Selected Authorization Profile admi_profile

Example 2 :
13005 Received TACACS+ Authorization Request - AD
...
13034 Returned TACACS+ Authorization Reply

Request Type Authorization
Status Pass
Message Text Device-Administration: Session Authorization succeeded
Shell Profile admi_profile
Matched Command Set
Command From Device

Example 3:
13005 Received TACACS+ Authorization Request - AD
...
13034 Returned TACACS+ Authorization Reply

Request Type Authorization
Status Pass
Matched Command Set adminprofile
Command From Device show vpn-sessiondb full anyconnect
Message Text Device-Administration: Command Authorization succeeded

Thank you very much

[arslanbut9090]

The examples you provided are logs related to TACACS+ (Terminal Access Controller Access-Control System Plus) authentication and authorization on your ASA (Adaptive Security Appliance) device using ISE (Identity Services Engine). Here's a breakdown of the key points:

1. TACACS+ Authentication (Example 1):

• Who Initiates: The ASA device initiates the TACACS+ Authentication Request to ISE.
• Username Used: The "Username" used is the one configured on the ASA device.
• Purpose: This is the initial step where the ASA requests authentication from ISE. The ASA sends an authentication request to ISE, and ISE replies with the status of the authentication (success or failure).

2. TACACS+ Authorization (Example 2):

• Who Initiates: The ASA device initiates the TACACS+ Authorization Request to ISE.
• Username Used: The "Username" used is the one configured on the ASA device.
• Purpose: This is the authorization step where the ASA requests authorization for device administration from ISE. The ASA sends an authorization request to ISE, and ISE replies with the status of the authorization (success or failure).

3. TACACS+ Command Authorization (Example 3):

• Who Initiates: The ASA device initiates the TACACS+ Authorization Request for a specific command to ISE.
• Username Used: The "Username" used is the one configured on the ASA device.
• Purpose: This is similar to Example 2 but specifically for command authorization. In this case, the ASA is seeking authorization for a specific command (show vpn-sessiondb full anyconnect). ISE replies with the status of the command authorization.

Impact of Deleting Username from ISE:

• If you delete the "Username" from ISE that is configured on the ASA device, authentication and authorization may fail. Ensure that the user exists in ISE with the correct attributes and policies.

Recommendation:

• Always review the logs for any failed attempts or errors.
• Deleting a user in ISE should be done carefully to avoid service disruption.
• Consult the Cisco ISE and ASA documentation for more detailed information on log interpretation and best practices.

Please note that the specific details might vary based on your network configuration and policies. Always refer to Cisco documentation or consult with your network administrator for accurate guidance.

[arslanbut9090]

The ISE/TACACS logs on your ASA device provide insights into user authentication and authorization processes. Requests are  initiated by the ASA when a user tries to access it, using the local username configured on the ASA for authentication against ISE. Successful authentication and authorization are logged, detailing the applied profiles and permissions. Deleting a username from ISE can lead to authentication failures and loss of associated access rights, impacting user access and potentially complicating auditing efforts.

https://ggsaloncorvallis.com/hair_salon/