Wireless ---> Cisco ACS (To many logs)

Unanswered Question
Apr 12th, 2007

Hi,

We required to setup several IOS wireless points with MAC-address authentication using the cisco acs. I have it working but the problem is that even rouge devices try connecting and this causes loads of failed attempts in the failed report, there are about 8 attempts per second so imagine my database size. The question is??? Can I configure the ACS not to log failed attempts on the ACS?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
darpotter Fri, 04/13/2007 - 23:41

Tough one... if you switch off or limit the failed attempts you wont see genunine failures.

An alternative is to use our CSVSYNC tool to regularly download the logs to another PC (doesnt have to be a server). Once there our AAA-REPORTS! application can pre-filter the junk out of the failed (and other) logs as it imports. At the same time directory management on the ACS can be set to purge logs a short time after they've been downloaded.

You're then left with just the real failed attempts in our SQL DB backed report generator - from where you can either run canned reports or use our visual query builder to sort/filter/group/total/export the data.

josejames Sat, 04/14/2007 - 08:29

Hi,

The ideal solution would be if I could disable or rate limit the failed authentications for a specified device in the ACS.

Actions

This Discussion