Why do we see different MAC address format from ISE

[samarthashetty]

Hi team,

We are seeing a strange issue where logs from ISE are showing different MAC address format in Splunk. If we notice the logs on splunk we see few machines are with xx-xx-xx-xx format however few are xx:xx:xx:xx format. Could any let me know why is this?

regards

Sam

[Mike.Cifelli]

This format is an indicator of the Radius attribute 31 known as the Calling-Station-ID.  In ISE radius live logs you can see this in action.  This attribute is seen/used in Access-Request packets during onboarding.  Note that you can also reference this in certain policies within ISE as a condition.  HTH!

[samarthashetty]

Hi Mike,

thank you for information. SO you mean to say calling station ID mac address format in syslog will be xx-xx-xx-xx. Please correct me if i am wrong. thanks!

Regards

Sam

[hslai]

The NAD might have an option to send a specific format. For example, in IOS-XE,

radius-server attribute 31 mac format ietf upper-case

[thomas]

It is possible that different logs output MAC addresses with different delimiters: - or : or nothing at all.

What is the real issue?

[samarthashetty]

Hi thomas.. I understand that we may see the MAC address with different format across. All we need is to have uniformity across ISE logging where we can. Please let me know how can we achieve this. 

Regards

Samarth

[thomas · Accepted solution]

ISE can take in MAC addresses of different formats and normalize them.

However, there is no option to uniformly format all MAC addresses in the ISE GUI and and logs to a single, consistent format.

You may submit this as a feature request / enhancement along with your details of the specific logs that you have found that are inconsistent and how it causes problems.

I would think Splunk would easily be able to parse and match MAC addresses with any delimiter.