Integrate CS-ACS and CS-MARS

[Eugen Bitca]

Hello,

CS-ACS (CiscoSecure ACS v4.2) was configured to send "Failed Attempts" logs to CS-MARS (Appliance Product Version: 6.0.2).

ACS was added to MARS as a "Cisco Secure ACS SE 4.x" appliance.

TCPDUMP at the MARS CLI shows that MARS is receiving syslog traffic on port 514 from the ACS, but when I submit an inline query to determine whether events are being received from the Cisco Secure ACS, it shows empty report.

Thanks a lot

[antonio.barrantes]

Hi Eugen,

Could you try a query in real time with the option "Event raw messages"?

Is possible that doesn´t match correctly.

Best Regards

Antonio

[Eugen Bitca]

Hi Antonio,

A real time query returns:

Event Type: Secure ACS Auth failed: password invalid

Reporting Device: ACS42

RAW Message:

<38>Jun 13 11:45:23 10.44.1.4 CisACS_02_FailedAuth nas0259t 1 0 Message-Type=Authen failed,User-Name=eugen,NAS-IP-Address=10.44.1.18,Authen-Failure-Code=ACS password invalid,Caller-ID=172.22.5.10,NAS-Port=tty1,Group-Name=Group 1 (NetAdmin - Full),

10.44.1.4 - ACS IP address

--------------------------------------------

I made rulles that match "Secure ACS Auth failed" Event Type, so MARS will announce when there are attempts with invalid password or unknown user.

Thank you.

[antonio.barrantes]

You are welcome Eugen.

Regards