Send syslog for each new WMI session (passive id)

[Michal Garcarz]

Hello Team,

Could you confirm: is it possible for ISE to send syslog message for every new WMI session discovered passively ?

As far as i see in my Splunk: it's NOT. Passiveid service is just for service (not for dataplane/sessions).

(i have almost all components configured to send syslogs to Splunk).

Please confirm - maybe i am missing something.

ISE not doing any authentication.

Thanks,

[kvenkata1 · Accepted solution]

is your flow similar to the one described in this nicely written Techzone article? If so, the answer is Yes.

https://techzone.cisco.com/t5/Identity-Services-Engine-ISE/Configure-EasyConnect-on-ISE-2-1/ta-p/842096

Do you have access to ISE & did you check the Live logs?

- Krish

[Michal Garcarz]

Hi Krish,

Thanks for the help.

My use case is different - as mentioned ISE is not doing any authentication - with Easy Connect it does.

So i do assume the answer is: ISE is not able to send syslog for passively discovered mappings/sessions, but only for those for which authentication is done.

Correct ?

Thanks,

Michal

[kvenkata1]

If the flow is different from what is documented in the link I sent you, then the answer depends. Can you verify what you see in ISE logs?

- Krish

[Michal Garcarz]

I see no logs in ISE - as i have mentioned already: ISE is not doing ANY authentication ;)

Thanks,

[kvenkata1 · Accepted solution]

In that case no Syslogs may be available. Needs to be a new feature & please connect with the ISE PM team.