cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

191
Views
0
Helpful
4
Replies
Highlighted
Beginner

When Using Cisco ISE Identity PSK - the WLAN keys show in Live Log details

With current configuration setup for ISE and ID-PSK, using Cisco AV Pairs in the Authorization profile to hold the network key - these attributes in the Authorization profile are shown in clear text in the Live log details. The ISE Live Logs are accessible - typically by lowest level admins in ISE (i.e. HelpDesk). Is there a way to hide or block these components of the Authz Profile from showing in the live logs? Looking for something similar to how invalid user credentials/identity can be blocked via RADIUS protocol settings from showing in live logs and Live log details

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

4 REPLIES 4
Highlighted
VIP Mentor

Hi

All attributes are shown for troubleshooting purpose and as far as i know, there's no way to hide them.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Highlighted

I kind of figured as much. For corporations leveraging this feature, this can put lower-tier support team enablement at odds with the security of the wireless network. (As secure as WPA2-PSK is in this day and age). One of the great benefits of ISE is the HelpDesk/Operations role can be given to anyone within the organization in the Endpoint management/support path and with very quick tutorial they can become more efficient at resolving issues faster and within lower support bands. This exposure of the network keys changes that.

 

Highlighted

If security is of ultimate concern why not create guest accounts and require secure SSID with Dot1x?
Highlighted
Cisco Employee

Content for Community-Ad