cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1384
Views
10
Helpful
6
Replies
samarthashetty
Beginner

Why do we see different MAC address format from ISE

Hi team,

We are seeing a strange issue where logs from ISE are showing different MAC address format in Splunk. If we notice the logs on splunk we see few machines are with xx-xx-xx-xx format however few are xx:xx:xx:xx format. Could any let me know why is this?

 

regards

Sam

 

1 ACCEPTED SOLUTION

Accepted Solutions

ISE can take in MAC addresses of different formats and normalize them.

However, there is no option to uniformly format all MAC addresses in the ISE GUI and and logs to a single, consistent format.

You may submit this as a feature request / enhancement along with your details of the specific logs that you have found that are inconsistent and how it causes problems.

I would think Splunk would easily be able to parse and match MAC addresses with any delimiter.

View solution in original post

6 REPLIES 6
Mike.Cifelli
VIP Advisor

This format is an indicator of the Radius attribute 31 known as the Calling-Station-ID.  In ISE radius live logs you can see this in action.  This attribute is seen/used in Access-Request packets during onboarding.  Note that you can also reference this in certain policies within ISE as a condition.  HTH!

Hi Mike,

 

thank you for information. SO you mean to say calling station ID mac address format in syslog will be xx-xx-xx-xx. Please correct me if i am wrong. thanks!

 

Regards

Sam

The NAD might have an option to send a specific format. For example, in IOS-XE,

radius-server attribute 31 mac format ietf upper-case

 

thomas
Cisco Employee

It is possible that different logs output MAC addresses with different delimiters: - or : or nothing at all.

What is the real issue?

Hi thomas.. I understand that we may see the MAC address with different format across. All we need is to have uniformity across ISE logging where we can. Please let me know how can we achieve this. 

 

Regards

Samarth

ISE can take in MAC addresses of different formats and normalize them.

However, there is no option to uniformly format all MAC addresses in the ISE GUI and and logs to a single, consistent format.

You may submit this as a feature request / enhancement along with your details of the specific logs that you have found that are inconsistent and how it causes problems.

I would think Splunk would easily be able to parse and match MAC addresses with any delimiter.

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars


Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube