Remote Syslog Settings

[Mstuetzel]

Working on forwarding Radius accounting logs to a remote syslog (secure) In our lab that has PAN/PSN/MNT all on the same node it looks to be working correctly but our production has PAN/MNT and PSN separated. What server actually forwards the logs. I believe I read that the MNT should handle this job but we are not seeing any logs.

[Francesco Molino]

Hi

You can check out on the ISE node communication to know every flows by nodes. This design can be found in the administration guide:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_0110.html

Here the picture:

Have you checked if you see logs coming from PSN nodes?

[Mstuetzel]

hmm will have to see. from the tcpdump I don't see any packets for those destinations on the psns or the pan/mnt the document is helpful but I don't see the option for a remote logging server to offload the logs.

[Damien Miller]

You will get forwarded syslogs directly from the PSNs. Adding a remote syslog target means they still send to the MNT, but the MNT doesn't actually forward them, the PSNs will send the same logs twice.

[Mstuetzel]

I ran pcaps on ISE pan for the PSNs while the other team was watching from logs the only logs he was able to see was from the Admin node for alarms or configuration changes. not seeing anything from the PSNs or the PAN/MNT for radius accounting logs. I also setup an alarm for the remote server blocked access to it but the alarm never tripped as soon as I removed the ACL it started sending the normal system logs not radius accounting logs.

[Damien Miller]

Have you done the following? It takes two steps to export syslogs to a remote target, defining the target, and defining the remote target on the log categories.  

Step 1 - Define the external syslog server as a remote logging target. Click add on this page and fill in the required details.

Step 2 - Add your new remote logging target (external syslog server) to the logging categories you want to export. Radius accounting as an example.  

[Francesco Molino]

Damien already replied.
As he mentioned, you'll need to define which logs you want to export to your remote target.