ISE Guest Activity Report

[descalante2007]

In accord with the user guide, ISE should be able to report what URLs a guest had visited. For this functionality to work "you must enable guest access syslogging configuration on the NAD that inspects guest traffic in your Cisco ISE network".

How can I do that if my guest users only have access through wireless? I mean what should I config in the WLC?

Thanks in advance

[Tarik Admani · Accepted solution]

You may need to look at your firewall config, and use a policy map to perform url filtering. Here is a nac guest server solution that will help.

http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080ac2fda.shtml#asac

Thanks,

Tarik Admani
*Please rate helpful posts*

[descalante2007]

We will start test whit this reports for next few days, but I receive from a couple of questions from the customer:

Is it possible to set the firewall sending syslog messages to another repository and then set the ISE to retrieve data from it in order to precess and generate this report?

I saw in the ISE, the logging categories and guest as one of them... Is it here where I should set what is requested?

Where in the ISE file structure is recorded the syslog messages? Is it possible to make a backup for this data and process in the ISE later? ... Imagine an user is catched accessing a forbiden URL, and the manager likes to know if this action had happen before? How long will the ISE kept old data and if it is the case, what should be backed up to kept old data for further analysis?

Regards.

[Anas Naqvi]

In Cisco ISE, system logs are collected at locations called logging targets. Targets refer to the IP addresses of the servers that collect and store logs.

ISE has the following default targets, which are dynamically configured in the loopback addresses of the local system:

•LogCollector—Default syslog target for the Log Collector.
•ProfilerRadiusProbe—Default syslog target for the Profiler Radius Probe.

You can generate and store logs locally, or you can use the FTP facility to transfer them to an external server.

Please check the following link,

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_logging.html#wp1076091

[manjeets]

Please find the attachment.

[descalante2007]

Thank you for the document. I find it very usable although unfortunately didn't answer my questions:

Is it possible to send syslog messages to another syslog server instead of ISE, and the configure the ISE to get the data from that third device?. I think it is not, but can I be missing a trick or an alternative solution?

Where in the ISE server are the syslog messages recorded and how can I know how much disk space is being used in order to do backups before the disk began to be exhausted?

Regards.