ISE Guest activity reports configuration

Hi All,
I am trying to obtain guest activity report pertaining to the websites accessed by the guests. I have a standalone ISE deployement (1.1.2) running all personas. I am following the instructions on this document in a way:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080ac2fda.shtml#asac
I have configured the sysloging on my ASA gateway this way:
logging on
logging list WebLogging message 304001
logging trap WebLogging
logging facility 21
logging host inside <ISE-ip-address> 17/20514
I also configured http inspection:
policy-map global_policy
class inspection_default
inspect http
service-policy global_policy global
Accounting is configured on the WLC and pointing to the ISE node.
I am using CWA for guest access. This is working as expected. The Sponsor creates the account then the guest logs in successfully using the account created. I only need to have the guest activity reported. So far no luck and the activity report is empty. Any pointers are greatly appreciated.
Fadi

Hi Fashour:
I will began test to generate this kind of reports soon (I need to wait por authorization to get access to ASA and change current config) I have some questions:
Did you configure something in the ISE to enable it as syslog server?
Can it be possible that you paste an image with the report results as a sample? I like to show my company and my customer what kind of reports we should expect ..
Regards.

Similar Messages

ISE Guest Activity Report not working (1.2.0.899)

Recently I upgraded an ISE to 1.2.0.899. I found the Guest Activity Report is not working. Before the upgrade it was working properly (with the limitation of 5000 records by report). Nothing in the ASA was modified, but nothing is reported in the ISE; also I use the tcpdump integrated in the ISE to validate the syslog messages are arriving from the ASA to the ISE. I already enable the Passed Authentication logging category.
Do I need to modify something else,to have the report?

Hi
Please make sure these steps has configured correctly:
Step 1 Create an alarm, as described in Creating, Editing, and Deleting Alarm Schedules.
Step 2 Specify a rule for Passed Authentication, Failed Authentications, or Authentication Inactivity for all users of type guest, as described in Creating and Assigning an Alarm Rule.
Step 3 Calculate guest user activity by Monitoring Live Authentications.

ISE Guest Activity Report

In accord with the user guide, ISE should be able to report what URLs a guest had visited. For this functionality to work "you must enable guest access syslogging configuration on the NAD that inspects guest traffic in your Cisco ISE network".
How can I do that if my guest users only have access through wireless? I mean what should I config in the WLC?
Thanks in advance

In Cisco ISE, system logs are collected at locations called logging targets. Targets refer to the IP addresses of the servers that collect and store logs.
ISE has the following default targets, which are dynamically configured in the loopback addresses of the local system:
•LogCollector—Default syslog target for the Log Collector.
•ProfilerRadiusProbe—Default syslog target for the Profiler Radius Probe.
You can generate and store logs locally, or you can use the FTP facility to transfer them to an external server.
Please check the following link,
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_logging.html#wp1076091

Standard Portal activity report configuration and Universal worklist config

Hi,
I need help for follwong topics:
Standard Portal activity report configuration and Universal worklist configuration.
Thanks & Regards
Sushama Pandey

Hi
Check this
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/904ca240-63bc-2a10-1c98-de81b6a045bf

Guest Activity on Cisco ISE

Is it possible to monitor the web pages visited for a guest using cisco ISE?

Hi Gino,
Yes, you can use the Guest Activity option. The Guest Activity report provides details about the websites that guest users are visiting. You can use this report for security auditing purposes to demonstrate when guest users accessed the network and what they did on it.
This report is available at: Operations > Reports > Endpoints and Users > Guest Activity.
To use this report you must first:
•Enable the passed authentications logging category. Choose Administration > Logging > Logging Categories and select Passed authentications.
•Enable these options on the firewall used for guest traffic:
–Inspect HTTP traffic and send data to Cisco ISE Monitoring node. Cisco ISE only requires the the IP address and accessed URL for the Guest Activity report so, if possible, limit the data to include just this information.
–Send syslogs to Cisco ISE Monitoring node
Please check the below link for further information,
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_guest_pol.html#wp1056645

ISE 1.3 Guest Activity

Hello,
is in the ise version 1.3 a possiblity that I can display the Guest Activity and export it via FTP?
What I'd like to see is: Which user opens which website/service. What kind of activity is the guest doing during he is using our guest wifi.
Regards
Filip

Hello Filip. No such an option is available in ISE. Moreover, only the Guest authentication traffic hits ISE. Once the guest user is authenticated the traffic no longer flows through ISE, thus, ISE has no visibility to what the user is actually doing on the network.
This sort of information would be best collected by your web security appliance. So for instance, if you have Cisco WSA/CWSA.
Thank you for rating helpful posts!

Guest users in Portal Activity Report

Hi All,
We have implemented Portal Activity Report in our portal. We are tracking only the pages and we have set the property Authentication Scheme to default for all the pages.
The reports are working fine except for the fact that the reports are showing up large number of anonymous users logging in as Guest for e.g. Guest 1, Guest 2, Guest 3 etc. Our landscape has no Anonymous users.
Can anyone tell me why the report is showing up large number of Guest users (Type - Anonymous Users) though we donu2019t have any anonymous Users?
How to get rid of these Anonymous Guest users in the Portal Activity Report?
Kindly help me to resolve this issue.
Regards,
Adren D'Souza

Hi Adren,
The AR shows what it gets.
The first posibility, is somewhere anonymous users do have access to content or some operations are being considered as anonymous.
I suggest to check all the properties which should disable the anonymous, whether there is any content which is exposed as anonymous:
1)Search the roles which are assigned to Guest user.
2)Make sure that the "Guest" user is disabled.
The second possibility u2013 there is an old data in DB tables.
What type of report are we discussing? Is this the "Details about the users who logged on" report?
If it is, check the WCR_* DB tables whether there any u2018au2019 type users.
If there is, I would recommend you to delete those entries ("WHERE USERTYPE = 'a'), it could be the old data, before you have applied the note.
Best Regards,
Victoria Gur
| Installed Base Development Engineer
| NetWeaver Portal Platform
| SAP Labs Israel

Portal Activity Report query

Hello All,
The Portal Activity Report shows data under Authenticated and Anonymous Columns
Questions:
1. Portal is not configured for anonymous authentication. So from where does it collect data and show data under anonymous column?
2. How can I disable the anonymous part? And done so, will this have any affect on the way the Authenticated figures are collected?
Please share your experience on this.
Awaiting Reply.
Thanks,
PRanjan

Even if you don't think you have any anonymous access, there is a default user Guest who is part of the Anonymous Users group who seems to access the portal!
Not sure how to hide it. Sorry...

ISE Guest Accounting Identity

Hello Guys,
i have an ISE 1.2 with Patch 9 installed.
Now i want to have a correlated View of Guest User Name <-> IP Address
When i go under Operations -> Reports -> Guest Accouting i just get the MAC Adress as Identity Value. Is there any configuration i can made to show the GuestUser as Identity ?
I added a picture of my corrent output
Thanks
Philip

Guest user Identity is getting updated with Mac addr. instead identity
CSCuh14138
Description
Symptom:
Guest user Identity is getting updated with Mac. address instead of identity in Guest accounting reports.
Conditions:
issue is seen in Guest accounting reports
Workaround:
no work around
Known Affected Releases:
(4)
1.2(0.852)
1.3(0.566)
1.3(0.620)
1.2(0.899)

No data in Portal Database tables for Activity Report

Hi experts,
I've developed an Activity Report application in SAP Portal 7.0, which went live but the report shows no data.
We are pulling data from 2 portal database tables: WCR_WEBCONTENTSTAT and WCR_USERPAGEUSAGE
In non production environment there is data in the report but there is no data in the production environment.
The Activity Report service is already activated/started and set to true.
What could have caused this? And what should we check now?
What other configurations/setup should be done?
Regards,
Greg

Hi Greg,
Those are the aggregated tables. If they are not filled with data although the Portal Activity Report is activated, you should check whether the aggregation finished successfully.
In the older SPs there were some problems that were fixed in later SPs of 7.0.
In order to have the latest version of Portal Activity report, you can check SAP note 1084379 - Portal Activity Report - Latest Version (SDA file).
You can compare the SP via the MANIFAST file, as it contains the version and SP number.
In order to troubleshoot problems in Activity Report, you can follow SAP note: 1690023 - Portal Activity Report - Component-specific Note
Some basic checks that you can do:
Run query on the raw data tables to check since when there is data in those tables:
select min(timestamphour) from SAP<SystemID>DB.WCR_WEBCNODESTAT;
If there is too much data from long time ago, then you should delete the old data, and leave only the new data (there is anyways retention time for the data to be kept).
If there is no data, then it means that the Portal Activity Report does not collect data, and not really activated (usually this is not the case).
The aggregation runs every top of the hour, so you can check in the default traces for an error during that time.
In most of the cases something went wrong while aggregating the data.
As a result the aggregation is not finished, so the transaction is not being committed, and the aggregated tables stay empty.
If there is a DuplicateKeyException in the trace, you can follow SAP note 1054145 - Duplicate Key Exception.
If you have any more questions, please don't hesitate to ask.
I hope this information helps,
Thanks & regards,
Michal Zilcha-Lang

How to execute the Portal Activity Report

Hello,
In the System Administration -> System Configuration-> Service Configuration Editor
Under Applications->com.sap.portal.activityreport.core-> Services->ActivityReport and I have configured the report.
I saved I have restarted the service to effect the changes and in Portal Catalog
Application->com.sap.portal.activityreport.core and I have administrated the changes. The Application Details Editor is displayed.
I have clicked the Restart the portal also.
I would like to know how to execute this Portal Activity Report after making this configuration.
Can anyone help me.
Thnx in advance
cheers
Kris

Hi Kris,
here an example with steps:
1. Navigate to Content Administration -> Portal Content
2. Step into a test folder and right click on the folder to create a new iView
2. Select the template "Portal Activity Report iView"
   Name: Daily User Logins
   Technical Name: DailyUserLogins
3. Open the newly created iView and define the following parameters
   under "Specify report content"
      Start of Reporting: Date 01.01.2005 and Time: 08:00
      End of Reporting: Date 31.12.2005 and Time: 24:00
      Time Unit for Reporting: Daily
   under "Configure report options"
      Information to Report: Number of users logged on
You have created a new reporting iView, aggregating information about the number of anonymous and authenticated users on a daily basis.
Hope this helps,
Robert

Portal Activity Report

Hi,
I am working on EP 7.0 SP 18. I have created an Activity Report iView to track which users have used my WebDynpro application.My Wedynpro application is on a page and the Monitor User property of the page is also turned on.
I am able to see the data for some days but it does not show any data for the later days.
What could be the problem? The raw data gets saved in the portal database.Is there any limit to the data that can be stored.I configured my Service to save data every 5 minutes.
Pls Help.
Warm Regards
Saurabh

Try taking the report every hour or so Rather than every 5 minutes .. as far as i know there is No limit to the amount of portal activity that you can store other than the actual size of the database ..
other than that i am pasting a few links which you might know but might still be of some use to you . ..
http://help.sap.com/saphelp_nw70/helpdata/EN/47/873c9dc84a199ce10000000a42189d/frameset.htm
In the link below this topic has already been discussed but not the detail you are requesting ...
Portal Actvity reporting
and
http://help.sap.com/saphelp_nw04/helpdata/de/b5/c652070d474533a18a930112a4b926/frameset.htm
Regards ,
Manthan.

Portal activity report(image problem).

Hi All,
I have a problem in Portal Activity report of Number of users who logged on.
In "Number of users who logged on" report, there is one java image(applet).It is not rendering. It is giving the error :
Java Plug-in 1.6.0_01
Using JRE version 1.6.0_01 Java HotSpot(TM) Client VM
User home directory = C:\Documents and Settings\km39649
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
p:   reload proxy configuration
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
Piglet Version 1.1.35 - 07.12.01
java.lang.NullPointerException
     at com.sap.miniapps.graphics.CategoryChart.setChartType(CategoryChart.java:898)
     at com.sap.miniapps.graphics.Piglet.init(Piglet.java:268)
     at sun.applet.AppletPanel.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
Exception in thread "Thread-7" java.lang.NullPointerException
     at sun.plugin.util.AnimationPanel.createTranslucentImage(Unknown Source)
     at sun.plugin.util.AnimationPanel.createGradientShapeImage(Unknown Source)
     at sun.plugin.util.AnimationPanel.initBackground(Unknown Source)
     at sun.plugin.util.AnimationPanel.preloadResources(Unknown Source)
     at sun.plugin.util.AnimationPanel.doPaint(Unknown Source)
     at sun.plugin.util.AnimationPanel.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
Can any one please help me why it is coming?
Thanks in Advance,
Kavitha

I am using ORACLE.
Actually the iview is the standard par iview, so i have created it from the "iview from Par" and that too in my test server seperately. I have created a new folder and under it i have created this new iview from Par. I have taken the com.sap.km.activityreport.frontend. and under this the activity report component.
I have also restarted the Data collection service. Other than these I did not do any other configurations. Any thing else is required?
Thanks in advance,
kavitha

Activity report does not seem to work

Hello,
We have a EP based on NW2004s Support Package Stack 10. The properties of the activity report are set so that the report is activated. When I look at the statistics within the activity report, the last aggregation is about a month ago and there is not data displayed for the current day. From the documentation I have learned that there is not other configuration necessary in 7.00 (in 6.40 you had to configure the aggregation separately). What could be the cause of the data not being displayed and not being aggregated? I have restarted the application a number of times, but to no avail. The entire portal has also been restarted in the mean time, but the situation stays the same.
Best regards, Wilbert

Hi Wilbert,
If your landscape is a clustered landscape, please verify that all servers have their time synchronized.
The background is as follows: The aggregation runs through a temp DB table and aggregates all timestamps to an hourly timestamp (into a different DB table, deleting the corresponding entries in the first table). If two servers are out of synch, one server may write an entry with a timestamp of the hour which should have been aggregated before. In this case, the next aggregation tries to create a new aggregated entry for the hour in question, but fails, as such an entry already exists. The problem is, that with this exception, the whole aggregation process stops.
To overcome this problem, you will have to delete the "overlapping" entries in one of the two tables in question. I could provide more infos if you say "time synch in fact was an issue"...
Hope it helps
Detlev

Guest Anchor with web auth using ISE guest portal

Hello All,
Before launching into my exact issues, could anyone confirm if they have completed a wireless Guest anchor setup using 2504 controllers on 7.4 as the anchor (5508 is the foreign) with webauth external redirection at ISE 1.1.3 using ISE Guest Services?
I am attempting this for an internal POC and have hit a couple of issues. Firstly I am looking for correct configuration confirmation prior to going in depth with a couple of the issues. I've been using the TrustSec 2.1 how to guides to build the parts I am not strong on so if anyone has actual completed this setup, I'd love to go through it with you.
massive thanks to anyone that can assist.
JS.

Thanks for the reply RikJonAtk.
so to start with, based on the trust sec documents, of the guest WLAN on the anchor I need to configure mac filtering at the layer 2 security menu as well as enable RADIUS NAC under the Advanced tab. But when I do this, I get an error message that states that mac filitering and RADIUS NAC cannot be enable at the same time.
Additionally, if I just enable the RADIUS NAC setting under the Advanced tab in the WLAN, I get another error message that states that the priority order for Web-Auth can only be set for radius, so I go to the AAA server tab and send local and LDAP to the not use column and hit apply. If I move to another menu then check the priority order again under the AAA servers tab, the local and LDAP have been moved back to the menu field to be used again. So I initially though it might be a bug, but I was hoping to find someone here that has done this already and can look at my issues and maybe walk me through their configs, which I'll mirror and see how it goes.
Thanks in Advanced,
JS

ISE Guest activity reports configuration

Similar Messages

Maybe you are looking for