Configuring ACS 5.x to send customized Alarms to ACS admin
We can use ACS 5.x for sending alarms, if it meets a certain threshold for certain condition, by default there are 4 alarms:
If we want ACS to notify us via e-mail about few other aspects explained below, that can be done.
Step 1. Access ACS gui --> monitoring and reports --> Alarms --> Thresholds and click on create.
STEP 2. Under General tab you can mention a name that help you relate to the alarm you want to configure and enable the alarm.
STEP 3. Under criteria we need to specify the parameter that ACS is supposed to monitor and send an alert when the threshold is crossed.
The categories available are:
ACS, if configured will monitor the above mentioned categories.
STEP 4. Next steps would be to configure the threshold :
In the above screen shot I have chosen category as “passed authentication”, I can optionally choose between the options mentioned in STEP 3. In the threshold we can mention what is the limit for the passed authentication in the given time frame and for a given ACS instances, if this threshold is crossed, ACS is supposed to generate an alarm and send an e-mail to the administered.
STEP 5. In addition to this ACS provides us the option for defining filters, so that the alarm can be specifically generated for following parameter:
That means ACS will calculate the threshold for those devices, which matches the filter.
STEP 6. Now, under “notifications” section, you can choose the severity for which ACS is supposed to send the alarm.
STEP 7. For the user list ACS will pull up (when we click select), those user e-mail ID’s which have been defined under ACS gui > System Administration > Administrators > Accounts
STEP 8. Click submit
Let’s say if we want ACS to generate alarm if the user fails authentication more than 10 times in past 2 minutes, following will be my threshold configuration.
Additionally, ACS dashboard, will show the “alarm count”, which is supposed to increase when particular request hits the threshold.
Please feel free to comment in case of any query.
User wondering, if she using LDAP for external authentication, can she use the internal identity attribute?
for example : i create an user X , his password type is LDAP, but the identity group is "Group 1" can i define rules Idenitty Group in "Group 1" permit access ? or i need to do group mapping first?
It is possible to define an internal user whose password is taken from an external store. In internal user definition select "Password Type" to be the LDAP database and then define the rest of the user definition, including identity groups, as desired
I am running ISE 2.6 and I am doing PEAP outside with MSCHAPV2 inside for machine authentication I have AnyConnect 4.8 on the machine that is trying to authenticate. I get a message on ISE that says authentication failed due to incorrect password bu...
Hi, Don't ask why I have to replace a 2120 with a pair of 2110s - it's irrelevant :)The fact is, that I do indeed need to replace a 2120 with a pair of 2110s.The current 2120 is locally managed with FDM and the replacement HA pair of 2110s will also ...
Hi Team, I have a customer that has an ASA 5525-x V9.8(3)16 and purchased 500 AnyConnect Apex LicensesCustomer informed that licenses were converted to Smart licenses on the Cisco Site, and they suspect this Hardware not support licenses of this mode...
Dear Concern,Please be informed that we have purchased cisco FMC 4500-k9 appliance. We integrated FMC with cisco smart account. But our Export-Controlled feature is disable. Below is the screenshot for your reference: We are u...
I am running multiple NGFWv in our AWS environment from the marketplace. When trying to setup the EC2 instance for the firewall image and if I selected to encrypt the ebs volume with default aws/ebs key then the appliance does not respond on boot up. I al...