When you configure your Cisco ACS to send log data to USM Appliance, you can use the Cisco ACS plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin.
|Device Type||Access Control Server|
|Data Source Name||cisco-acs|
|Data Source ID||1594|
Integrating Cisco ACS
Before you configure the Cisco ACS integration, you must have the IP Address of the USM Appliance Sensor.
To configure Cisco ACS to send log data to USM Appliance
- Go to System Administration > Configuration > Log Configuration > Remote Log Targets.
- On the Remote Log Targets page, click Create.
Fill out the required fields
- Assign a name to the external syslog server, which in this case refers to USM Appliance.
- Enter the IP address of the USM Appliance Sensor.
- Select the target type, TCP Syslog or UDP Syslog.
- Enter the port number,
514 for TCP or UDP.
- Enter the maximum length for the log messages. The default value is 1024.
- Click Submit.
- Verify that the remote log target you created appears in the list.
- Go to System Administration > Configuration > Log Configuration > Logging Categories > Global.
- Select the logging category you want to use to send logs to USM Appliance, and then click Edit.
- Select the Remote Syslog Target tab.
Move the remote log target created in step 3, "loglogic" in the example below, to Selected Targets.
- Click Submit.
For plugin enablement information, see Enable Plugins.
For troubleshooting, see the vendor documentation.