Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Cisco ACS

The Cisco ACS DSM for JSA accepts syslog ACS events by using syslog and UDP mutliline.

JSA records all relevant and available information from the event. You can integrate Cisco ACS with JSA by using one of the following methods:

Configuring Syslog for Cisco ACS V5.x

The configuration of syslog forwarding from a Cisco ACS appliance with software version 5.x involves several steps.

You must complete the following tasks:

  1. Create a Remote Log Target

  2. Configure global logging categories

  3. Configure a log source

Creating a Remote Log Target

Creating a remote log target for your Cisco ACS appliance.

  1. Log in to your Cisco ACS appliance.

  2. On the navigation menu, click System Administration >Configuration >Log Configuration >Remote Log Targets.

  3. The Remote Log Targets page is displayed.

  4. Click Create.

    Configure the following parameters:

    Table 1: Remote Target Parameters

    Parameter

    Description

    Name

    Type a name for the remote syslog target.

    Description

    Type a description for the remote syslog target.

    Type

    Select Syslog.

    IP address

    Type the IP address of JSA or your Event Collector.

  5. Click Submit.

You are now ready to configure global policies for event logging on your Cisco ACS appliance.

Configuring Global Logging Categories

To configure Cisco ACS to forward log failed attempts to JSA:

  1. On the navigation menu, click System Administration >Configuration >Log Configuration >Global.

    The Logging Categories window is displayed.

  2. Select the Failed Attempts logging category and click Edit.

  3. Click Remote Syslog Target.

  4. From the Available targets window, use the arrow key to move the syslog target for JSA to the Selected targets window.

  5. Click Submit.

    You are now ready to configure the log source in JSA.

Syslog Log Source Parameters for Cisco ACS v5.x

If JSA does not automatically detect the log source, add a Cisco ACS v5.x log source on the JSA Console by using the syslog protocol.

When using the syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from Cisco ACS v5.x:

Table 2: Syslog Log Source Parameters for the Cisco ACS DSM

Parameter

Value

Log Source type

Cisco ACS

Protocol Configuration

Syslog

Log Source Identifier

Type the IP address or hostname for the log source.

The identifier helps you determine which events came from your Cisco ACS appliance.

Configuring Syslog for Cisco ACS V4.x

The configuration of syslog forwarding from a Cisco ACS appliance with software version 4.x involves a few steps.

Complete the following steps:

  1. Configure syslog forwarding

  2. Configure a log source

Configuring Syslog Forwarding for Cisco ACS V4.x

Configuration of an ACS device to forward syslog events to JSA.

Take the following steps to configure the ACS device to forward syslog events to JSA

  1. Log in to your Cisco ACS device.

  2. On the navigation menu, click System Configuration.

    The System Configuration page opens.

  3. Click Logging.

    The logging configuration is displayed.

  4. In the Syslog column for Failed Attempts, click Configure.

    The Enable Logging window is displayed.

  5. Select the Log to Syslog Failed Attempts report check box.

  6. Add the following Logged Attributes:

    • Message-Type

    • User-Name

    • Nas-IP-Address

    • Authen-Failure-Code

    • Caller-ID

    • NAS-Port

    • Author-Data

    • Group-Name

    • Filter Information

    • Logged Remotely

  7. Configure the following syslog parameters:

    Table 3: Syslog Parameters

    Parameter

    Description

    IP

    Type the IP address of JSA.

    Port

    Type the syslog port number of JSA. The default is port 514.

    Max message length (Bytes) - Type

    Type 1024 as the maximum syslog message length.
    Note:

    Cisco ACS provides syslog report information for a maximum of two syslog servers.

  8. Click Submit.

    You are now ready to configure the log source in JSA.

Syslog Log Source Parameters for Cisco ACS v4.x

If JSA does not automatically detect the log source, add a Cisco ACS v4.x log source on the JSA Console by using the syslog protocol.

When using the syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from Cisco ACS v4.x:

Table 4: Syslog Log Source Parameters for the Cisco ACS DSM

Parameter

Value

Log Source type

Cisco ACS

Protocol Configuration

Syslog

Log Source Identifier

Type the IP address or hostname for the log source.

The identifier helps you determine which events came from your Cisco ACS appliance.

UDP Multiline Syslog Log Source Parameters for Cisco ACS

The Cisco ACS DSM for JSA accepts syslog events from Cisco ACS appliances with log sources that are configured to use the UDP Multiline Syslog protocol.

If JSA does not automatically detect the log source, add a Cisco ACS log source on the JSA Console by using the UDP Multiline syslog protocol.

The following table describes the parameters that require specific values to collect UDP Multiline syslog events from Cisco ACS:

Table 5: Syslog Log Source Parameters for the Cisco ACS DSM

Parameter

Description

Log Source type

Cisco ACS

Protocol Configuration

UDP Multiline Syslog

Log Source Identifier

The Packet IP address of the source data.

If you select Show Advanced options and you select the Use As A Gateway Log Source option, the Log Source Identifier can be any valid value and does not need to reference a specific server. The Log Source Identifier can be the same value as the Log Source Name. If you have more than one Cisco ACS log source that is configured, you might want to identify the first log source as ciscoacs1, the second log source as ciscoacs2, and the third log source as ciscoacs3.

Listen Port

The default port number that is used by JSA to accept incoming UDP Multiline Syslog events is 517.

You can use a different port. The valid port range is 1 - 65535.

Message ID Pattern

\s(\d{10})\s

Event Formatter

Select Cisco ACS Multiline from the list.

Cisco ACS Sample Event Messages

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Cisco ACS Sample Message when you use the Syslog Protocol

The following sample event is a passed authentication event.

Table 6: Highlighted Values in the Cisco ACS Event

JSA field name

Highlighted values in the event payload

Event ID

Passed_Authentications

Source IP

10.129.16.29

Destination IP

10.20.64.165

Destination Port

49

Username

qradar_user1