ISE 1.2 not logging failed authentications on guest portal (CWA)

[Dominic Stalder (old profile)]

Hi there

I think this is a bug but wanted to check, if someone knows a good reason why failed authentication attemps with non-existing user account are not logged on ISE 1.2 (CWA).

The different cases:

Case 1: existing user / wrong password -> logged

Case 2: no user / any password -> logged

Case 3: no user / no password -> logged

Case 4: non-existing user / any password -> not logged

In my opinion this is a critical case to be logged because this could be an indicator of a DoS attack or a password penetration test.

Thanks in advance and best regards

Dominic

[Venkatesh Attuluri · Accepted solution]

check this bug listed CSCuh49137

[Dominic Stalder (old profile)]

Hi vatullu

thanks man, you helped me a lot.

Regards

Dominic