When Using Cisco ISE Identity PSK - the WLAN keys show in Live Log details

[waynesymes]

With current configuration setup for ISE and ID-PSK, using Cisco AV Pairs in the Authorization profile to hold the network key - these attributes in the Authorization profile are shown in clear text in the Live log details. The ISE Live Logs are accessible - typically by lowest level admins in ISE (i.e. HelpDesk). Is there a way to hide or block these components of the Authz Profile from showing in the live logs? Looking for something similar to how invalid user credentials/identity can be blocked via RADIUS protocol settings from showing in live logs and Live log details

Thanks!

[Francesco Molino]

Hi

All attributes are shown for troubleshooting purpose and as far as i know, there's no way to hide them.

[waynesymes]

I kind of figured as much. For corporations leveraging this feature, this can put lower-tier support team enablement at odds with the security of the wireless network. (As secure as WPA2-PSK is in this day and age). One of the great benefits of ISE is the HelpDesk/Operations role can be given to anyone within the organization in the Endpoint management/support path and with very quick tutorial they can become more efficient at resolving issues faster and within lower support bands. This exposure of the network keys changes that.

[Jason Kunst]

If security is of ultimate concern why not create guest accounts and require secure SSID with Dot1x?

[Jason Kunst · Accepted solution]

Please reach out and provide http://cs.co/ise-feedback