topic Re: Challenge with Cisco ISE (Identity Service Engine) Integration for user-id mapping in General Topics

Challenge with Cisco ISE (Identity Service Engine) Integration for user-id mapping

risi76 — Wed, 23 Jul 2014 18:16:03 GMT

Hello All,

I am currently trying to integrate the cisco ise (radius server) to the Palo Alto Syslog filters so that the users that be tagged and policy applied to different categories of guest based on ISE permission.

Currently ISE seem to be sending authentication logs to Palo Alto but cannot seem to build the right regex to pull the relevant information.

Has anyone been able to do this?

Appreciate the response.

Best Regards

dan

Re: Challenge with Cisco ISE (Identity Service Engine) Integration for user-id mapping

HULK — Thu, 24 Jul 2014 14:53:52 GMT

Hello Dan,

It looks like, previously you have posted a similar query on this discussion forum, but still that is not answered. ( Cisco ISE Regex). In this situation, I would request you to consult with your Palo Alto SE for more relevant information.

Thanks

Re: Challenge with Cisco ISE (Identity Service Engine) Integration for user-id mapping

risi76 — Thu, 24 Jul 2014 18:15:09 GMT

Hi Hulk,

You are very correct

I must have forgotten, thanks for the reminder.

Best Regards

dan

Re: Challenge with Cisco ISE (Identity Service Engine) Integration for user-id mapping

DB10 — Wed, 18 Jul 2018 03:14:29 GMT

Keep in mind that this will NOT work in a multi-domain environment with Cisco ISE 2.x. There is an ongoing Cisco Defect preventing integration. If you need this function, please add your company to the Cisco defect listed below. This will help us for Cisco to prioritise a defect fix. At the moment Cisco allege we are the only organisation impacted. Please reply to the post on the Cisco Forums to advise you are impacted - https://supportforums.cisco.com/t5/aaa-identity-and-nac/are-you-impacted-ise-syslog-double-backslash/m-p/3417260

We would appreciate your support in helping convince Cisco to resolve this issue.

Defect Details

CSCvk09565 ISE 2.x onwards RFC 3164 is not being followed completely

Symptom

Syslog messages are sent with double slash in the username field.

Characters which are escaped with double slash are ,;{}\

Conditions

ISE 2.x version

Defect Details

CSCvk09565 ISE 2.x onwards RFC 3164 is not being followed completely

Symptom

Syslog messages are sent with double slash in the username field.

Characters which are escaped with double slash are ,;{}\

Conditions

ISE 2.x version

Workaround

None

Further Problem Description

Below characters are escaped as of now

,;{}\

No Character should be escaped as per RFC 3164 which ISE follows.

Workaround

None

Further Problem Description

Below characters are escaped as of now

,;{}\

No Character should be escaped as per RFC 3164 which ISE follows.