{"id":14147,"date":"2026-09-24T10:44:27","date_gmt":"2026-09-24T02:44:27","guid":{"rendered":"https:\/\/www.killtest.com.tw\/?p=14147"},"modified":"2026-09-24T10:44:27","modified_gmt":"2026-09-24T02:44:27","slug":"cisco-ise-%e8%88%87-splunk-ftd-%e8%81%af%e5%8b%95%e6%83%85%e5%a2%83%e4%b8%8b%e5%b8%b8%e8%a6%8b%e7%9a%84%e6%8e%92%e9%8c%af%e6%ad%a5%e9%a9%9f%e8%88%87%e5%af%a6%e6%a9%9f%e8%80%83%e9%a1%8c%e7%af%84","status":"publish","type":"post","link":"https:\/\/www.killtest.com.tw\/?p=14147","title":{"rendered":"Cisco ISE \u8207 Splunk \/ FTD \u806f\u52d5\u60c5\u5883\u4e0b\u5e38\u898b\u7684\u6392\u932f\u6b65\u9a5f\u8207\u5be6\u6a5f\u8003\u984c\u7bc4\u4f8b\u3002"},"content":{"rendered":"\n

\u5728 Cisco 350-701 SCOR v2.0 <\/a>\u7684\u5be6\u6a5f\u60c5\u5883\u8207\u9ad8\u968e\u6392\u932f\u984c\u4e2d\uff0c\u300cISE + pxGrid + FTD + Splunk\u300d<\/strong> \u69cb\u6210\u4e86\u73fe\u4ee3\u4f01\u696d\u96f6\u4fe1\u4efb\u52d5\u614b\u9632\u79a6\u7684\u9ec3\u91d1\u4e09\u89d2\uff1a<\/p>\n\n\n\n

                      +-------------------+\n                      |   Cisco ISE 3.x   |\n                      | (PDP: \u8eab\u4efd\/\u614b\u52e2\/SGT) |\n                      +-------------------+\n                        \u2502               \u2502\n       (pxGrid Context) \u2502               \u2502 (Syslog UDP\/TCP 514)\n                        \u25bc               \u25bc\n      +--------------------+      +--------------------+\n      |  Firepower FMC\/FTD |      |  Splunk Enterprise |\n      | (PEP: \u57fa\u65bc\u8eab\u4efd\u4e4b\u5b58\u53d6) |====> | (SIEM: \u5a01\u8105\u5206\u6790\/\u95dc\u806f)|\n      +--------------------+      +--------------------+\n               (eStreamer \/ NetFlow)\n<\/code><\/pre>\n\n\n\n
\u7576\u6b64\u806f\u52d5\u93c8\u8def\u767c\u751f\u6545\u969c\u6642\uff0c\u901a\u5e38\u6703\u5c0e\u81f4\uff1a<\/p>\n\n\n\n
    \n
  1. FTD \u7121\u6cd5\u8b58\u5225\u4f7f\u7528\u8005\u6216 SGT<\/strong>\uff0c\u5b58\u53d6\u63a7\u5236\u898f\u5247\uff08ACP\uff09\u56de\u9000\u5230\u9810\u8a2d\u963b\u65b7\u6216\u932f\u8aa4\u653e\u884c\u3002<\/li>\n\n\n\n
  2. Splunk \u6536\u4e0d\u5230\u8eab\u5206\u4e0a\u4e0b\u6587\uff08Context\uff09<\/strong>\uff0cSOC \u5206\u6790\u5e2b\u7121\u6cd5\u95dc\u806f IP \u8207\u771f\u5be6\u5e33\u865f\u3002<\/li>\n<\/ol>\n\n\n\n
    \u4e00\u3001 \u5e38\u898b\u6545\u969c\u9ede\u6392\u932f\u6b65\u9a5f\uff08Troubleshooting Workflow\uff09<\/p>\n\n\n\n
    1. Cisco ISE \u8207 FMC\/FTD \u7684 pxGrid \u901a\u8a0a\u5931\u6557<\/p>\n\n\n\n
    FTD \u4f9d\u8cf4 FMC \u900f\u904e pxGrid\uff08Port 8910 \/ WebSocket REST\uff09<\/strong> \u5411 ISE \u8a02\u95b1 Session Directory\uff08IP-to-User \/ IP-to-SGT \u6620\u5c04\uff09\u3002<\/p>\n\n\n\n
      \n
    • \u6b65\u9a5f 1\uff1a\u6aa2\u67e5 pxGrid \u7bc0\u9ede\u670d\u52d9\u8207\u5ba2\u6236\u7aef\u6388\u6b0a\u72c0\u614b<\/strong>\n
        \n
      • \u5728 ISE GUI \u5c0e\u822a\u81f3\uff1aAdministration > pxGrid Services > Clients<\/code>\u3002<\/li>\n\n\n\n
      • \u95dc\u9375\u6392\u67e5\u9ede<\/strong>\uff1aFMC \u662f\u5426\u8655\u65bc Approved<\/strong> \u72c0\u614b\uff1f\u82e5\u8655\u65bc Pending<\/code>\uff0c\u5fc5\u9808\u624b\u52d5\u9ede\u64ca\u300cApprove\u300d\u3002<\/li>\n\n\n\n
      • \u6191\u8b49\u4fe1\u4efb\u93c8\uff08\u5e38\u898b\u81f4\u547d\u932f\u8aa4\uff09<\/strong>\uff1apxGrid \u901a\u8a0a\u56b4\u683c\u8981\u6c42\u76f8\u4e92 TLS\uff08mTLS\uff09\u3002FMC \u7684\u6191\u8b49\u5fc5\u9808\u7531 ISE \u4fe1\u4efb\u7684 CA \u7c3d\u767c\uff0c\u4e14 ISE \u7684 pxGrid \u6191\u8b49\u5fc5\u9808\u5305\u542b\u5728 FMC \u7684\u53d7\u4fe1\u4efb CA \u5eab\u4e2d\uff1b\u6191\u8b49\u7684 SAN\uff08Subject Alternative Name\uff09\u5fc5\u9808\u5305\u542b FQDN\uff0c\u4f7f\u7528\u88f8 IP \u5e38\u5c0e\u81f4 TLS \u63e1\u624b\u5931\u6557\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • \u6b65\u9a5f 2\uff1a\u9a57\u8b49 FMC \u7aef Identity Source \u72c0\u614b<\/strong>\n
          \n
        • \u5728 FMC GUI \u5c0e\u822a\u81f3\uff1aSystem > Integration > Identity Sources > Identity Services Engine<\/code>\u3002<\/li>\n\n\n\n
        • \u9ede\u64ca Test<\/strong> \u6e2c\u8a66\u9023\u63a5\u3002<\/li>\n\n\n\n
        • \u82e5\u9023\u63a5\u5931\u6557\uff0c\u767b\u5165 FMC CLI \u57f7\u884c\u6392\u67e5\uff1aBash# \u6aa2\u67e5 FMC \u5230 ISE \u7684 8910 \u901a\u8a0a\u57e0\u9023\u901a\u6027 curl -vk https:\/\/<ISE_pxGrid_IP>:8910\/<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • \u6b65\u9a5f 3\uff1a\u78ba\u8a8d FTD \u4e0a\u7684\u8eab\u5206\u6620\u5c04\u8868\u662f\u5426\u540c\u6b65\u6210\u529f<\/strong>\n
            \n
          • \u767b\u5165 FTD CLI\uff0c\u57f7\u884c\u8a3a\u65b7\u6307\u4ee4\uff1aBash# \u6aa2\u67e5\u81ea FMC\/ISE \u4e0b\u767c\u7684\u7576\u524d\u767b\u5165\u4f7f\u7528\u8005\u8207 IP \u6620\u5c04 show user-identity user active # \u6aa2\u67e5\u672c\u6a5f SGT \u6a19\u8a18\u6620\u5c04\u8868 show cts environment-data show cts role-based sgt-map<\/code><\/li>\n\n\n\n
          • \u73fe\u8c61\u5224\u65b7<\/strong>\uff1a\u82e5\u6b64\u8655\u70ba\u7a7a\uff0c\u8868\u793a FTD \u6839\u672c\u672a\u6536\u5230 pxGrid \u63a8\u9001\u7684 Session\uff0c\u554f\u984c\u51fa\u5728 ISE-FMC \u4e32\u63a5\u6216 FTD \u7684 Identity Policy \u672a\u6b63\u78ba\u7d81\u5b9a\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
            2. ISE \u8207 FTD \u5230 Splunk \u7684\u65e5\u8a8c\u9001\u51fa\u7570\u5e38<\/p>\n\n\n\n
              \n
            • ISE Syslog \u6545\u969c<\/strong>\uff1a\n
                \n
              • \u6aa2\u67e5 Administration > System > Logging > Remote Logging Targets<\/code>\u3002<\/li>\n\n\n\n
              • \u78ba\u8a8d\u50b3\u8f38\u5354\u5b9a\uff08UDP 514 vs. TCP 6514 TLS\uff09\u8207 Splunk Indexer \/ Heavy Forwarder \u7684\u8f38\u5165\u76e3\u807d\u914d\u7f6e\u4e00\u81f4\u3002<\/li>\n\n\n\n
              • \u6aa2\u67e5 Logging Categories<\/code>\uff1a\u78ba\u4fdd Passed Authentications<\/strong>\u3001Failed Attempts<\/strong> \u8207 RADIUS Accounting<\/strong> \u5df2\u95dc\u806f\u81f3\u8a72 Remote Target\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n
              • FTD \/ FMC eStreamer \u8f38\u51fa\u4e2d\u65b7<\/strong>\uff1a\n
                  \n
                • FMC \u900f\u904e eStreamer\uff08Port 8302\uff09\u5411 Splunk eStreamer Client \u8f38\u51fa\u9023\u7dda\u8207\u5165\u4fb5\u4e8b\u4ef6\u3002<\/li>\n\n\n\n
                • \u767b\u5165 FMC GUI\uff1aSystem > Configuration > eStreamer<\/code>\u3002<\/li>\n\n\n\n
                • \u6aa2\u67e5\u662f\u5426\u5df2\u70ba Splunk \u4f3a\u670d\u5668\u7684 IP \u5efa\u7acb\u4e26\u4e0b\u8f09\u5ba2\u6236\u7aef\u6191\u8b49\uff08pkcs12\uff09\uff0c\u4e14\u6191\u8b49\u5bc6\u78bc\u672a\u5728 Splunk \u7aef\u914d\u7f6e\u932f\u8aa4\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                  \u4e8c\u3001 \u8a8d\u8b49\u5be6\u6a5f\u8003\u984c\u7bc4\u4f8b\u8207\u6df1\u5ea6\u89e3\u6790<\/p>\n\n\n\n
                  \u3010\u5be6\u6a5f\u60c5\u5883\u984c 1\uff1aFTD \u8eab\u5206\u578b\u5b58\u53d6\u63a7\u5236\u5931\u6548\u3011<\/p>\n\n\n\n
                  \u984c\u76ee\u80cc\u666f<\/p>\n\n\n\n
                  \u67d0\u4f01\u696d\u914d\u7f6e\u4e86\u96f6\u4fe1\u4efb\u5b58\u53d6\u63a7\u5236\u7b56\u7565\uff1a\u5c6c\u65bc Finance-Users<\/code> \u5b89\u5168\u7d44\uff08SGT 10\uff09\u7684\u8ca1\u52d9\u54e1\u5de5\uff0c\u5141\u8a31\u900f\u904e FTD \u5b58\u53d6\u8ca1\u52d9\u4f3a\u670d\u5668 10.200.1.50<\/code>\u3002<\/p>\n\n\n\n
                  \u8ca1\u52d9\u90e8\u54e1\u5de5 Alice<\/code>\uff08IP: 10.100.1.25<\/code>\uff09\u4f7f\u7528 802.1X \u6210\u529f\u767b\u5165\u7db2\u57df\uff0c\u4f46\u7121\u6cd5\u958b\u555f\u8ca1\u52d9\u7cfb\u7d71\u7db2\u9801\u3002<\/p>\n\n\n\n
                  \u62d3\u64b2\u8cc7\u8a0a<\/p>\n\n\n\n
                    \n
                  • ISE PSN \/ pxGrid IP<\/strong>: 192.168.10.15<\/code><\/li>\n\n\n\n
                  • FMC IP<\/strong>: 192.168.10.20<\/code><\/li>\n\n\n\n
                  • FTD Outside\/Inside<\/strong>: \u4ecb\u65bc\u7d42\u7aef\u7db2\u6bb5\u8207\u4f3a\u670d\u5668\u7db2\u6bb5\u4e4b\u9593<\/li>\n<\/ul>\n\n\n\n
                    \u8003\u751f\u64cd\u4f5c\u7d42\u7aef\u74b0\u5883\u65e5\u8a8c<\/p>\n\n\n\n
                    \u7d42\u7aef A\uff08FMC \u4e0a\u7684 Connection Events \u622a\u5716\/\u65e5\u8a8c\uff09\uff1a<\/strong><\/p>\n\n\n\n
                    Plaintext<\/p>\n\n\n\n
                    Time: 14:22:05 | Src: 10.100.1.25 | Dst: 10.200.1.50:443 \nInitiator User: Unknown | Initiator SGT: Unknown (0)\nAccess Control Rule: Default-Block-All | Action: Block\n<\/code><\/pre>\n\n\n\n
                    \u7d42\u7aef B\uff08FTD CLI \u8a3a\u65b7\u8f38\u51fa\uff09\uff1a<\/strong><\/p>\n\n\n\n
                    Bash<\/p>\n\n\n\n
                    > show user-identity user active\nTotal active users: 0\n<\/code><\/pre>\n\n\n\n
                    \u7d42\u7aef C\uff08ISE GUI\uff1aAdministration > pxGrid Services > Clients \u72c0\u614b\uff09\uff1a<\/strong><\/p>\n\n\n\n
                    Plaintext<\/p>\n\n\n\n
                    Client Name       | Status   | Subscribed Topics\n---------------------------------------------------------\nFMC-Primary-App   | Pending  | SessionDirectory\n<\/code><\/pre>\n\n\n\n
                    \u554f\u984c\u8207\u4efb\u52d9<\/p>\n\n\n\n
                      \n
                    1. \u6839\u64da\u4e0a\u8ff0\u65e5\u8a8c\uff0c\u5206\u6790\u70ba\u4f55 Alice \u7684\u9023\u7dda\u89f8\u767c\u4e86 Default-Block-All<\/code> \u898f\u5247\uff1f<\/li>\n\n\n\n
                    2. \u8003\u751f\u61c9\u57f7\u884c\u54ea\u4e00\u9805\u5177\u9ad4\u4fee\u6b63\u52d5\u4f5c\uff1f<\/li>\n<\/ol>\n\n\n\n
                      \u7b54\u6848\u8207\u5b98\u65b9\u89e3\u984c\u908f\u8f2f<\/p>\n\n\n\n
                        \n
                      1. \u539f\u56e0\u5206\u6790<\/strong>\uff1a\n
                          \n
                        • \u5118\u7ba1 Alice \u5728 ISE \u4e0a\u5df2\u5b8c\u6210 802.1X \u8a8d\u8b49\uff0c\u4f46 FMC \u5728 ISE \u7684 pxGrid \u5ba2\u6236\u7aef\u6e05\u55ae\u4e2d\u8655\u65bc Pending<\/strong> \u72c0\u614b\u3002<\/li>\n\n\n\n
                        • \u9019\u5c0e\u81f4 ISE \u672a\u6388\u6b0a FMC \u8a02\u95b1 SessionDirectory<\/code> \u4e3b\u984c\uff0cIP-to-User\/SGT \u6620\u5c04\u8cc7\u6599\u7121\u6cd5\u50b3\u905e\u7d66 FMC\uff0c\u9032\u800c\u7121\u6cd5\u4e0b\u767c\u7d66 FTD\u3002<\/li>\n\n\n\n
                        • FTD \u5728\u8655\u7406\u5c01\u5305\u6642\uff0c\u8fa8\u8b58\u8a72\u6d41\u91cf\u7684 User \u8207 SGT \u70ba Unknown<\/code>\uff0c\u7121\u6cd5\u5339\u914d\u653e\u884c\u898f\u5247 Allow-Finance-SGT10<\/code>\uff0c\u6700\u7d42\u843d\u5165\u5e95\u90e8\u7684 Default-Block-All<\/code> \u898f\u5247\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                        • \u4fee\u6b63\u6b65\u9a5f<\/strong>\uff1a\n
                            \n
                          • \u767b\u5165 ISE \u7ba1\u7406\u5f8c\u53f0\uff0c\u524d\u5f80 Administration > pxGrid Services > Clients<\/code>\u3002<\/li>\n\n\n\n
                          • \u9078\u53d6 FMC-Primary-App<\/code>\uff0c\u9ede\u64ca Approve<\/strong>\u3002<\/li>\n\n\n\n
                          • \u7b49\u5f85\u72c0\u614b\u8b8a\u70ba Connected \/ Approved<\/code> \u5f8c\uff0c\u5728 FTD \u4e0a\u91cd\u65b0\u57f7\u884c show user-identity user active<\/code>\uff0c\u78ba\u8a8d 10.100.1.25<\/code> \u8207 Alice<\/code>\u3001SGT 10<\/code> \u6210\u529f\u7d81\u5b9a\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                            \u3010\u5be6\u6a5f\u60c5\u5883\u984c 2\uff1aSplunk SPL \u5a01\u8105\u95dc\u806f\u8207 ANC \u52d5\u614b\u9694\u96e2\u3011<\/p>\n\n\n\n
                            \u984c\u76ee\u80cc\u666f<\/p>\n\n\n\n
                            SOC \u76e3\u63a7\u5718\u968a\u6536\u5230\u7591\u4f3c\u52d2\u7d22\u8edf\u9ad4\u6d3b\u52d5\u8b66\u5831\u3002\u653b\u64ca\u8005\u6b63\u5728\u5167\u7db2\u9032\u884c\u6a6b\u5411\u63a2\u6e2c\u3002\u8003\u751f\u9700\u8981\u4f7f\u7528 Splunk \u5206\u6790\u591a\u6e90\u65e5\u8a8c\uff0c\u78ba\u8a8d\u5a01\u8105\u4f86\u6e90\u5e33\u865f\uff0c\u4e26\u5728 Cisco ISE \u4e0a\u767c\u8d77\u7dca\u6025\u9694\u96e2\u3002<\/p>\n\n\n\n
                            \u8003\u751f\u64cd\u4f5c\u7d42\u7aef\u74b0\u5883\uff1aSplunk Search \u6aa2\u7d22<\/p>\n\n\n\n
                            \u8003\u751f\u5728 Splunk \u6aa2\u7d22\u6846\u5167\u57f7\u884c\u4ee5\u4e0b SPL\uff0c\u4e26\u7372\u5f97\u67e5\u8a62\u7d50\u679c\uff1a<\/p>\n\n\n\n
                            Splunk SPL<\/p>\n\n\n\n
                            index=security sourcetype IN (\"cisco:firepower:syslog\", \"cisco:ise:syslog\")\n| eval threat_ip=coalesce(src_ip, Framed_IP_Address)\n| stats values(user) as Account, values(cisco_message_id) as Events, count by threat_ip\n| where count > 50\n<\/code><\/pre>\n\n\n\n
                            \u67e5\u8a62\u8f38\u51fa\u8868\uff1a<\/strong><\/p>\n\n\n\n
                            threat_ip<\/strong><\/td>Account<\/strong><\/td>Events<\/strong><\/td>count<\/strong><\/td><\/tr><\/thead>
                            10.10.45.88<\/code><\/td>bob_contractor<\/code><\/td>113015<\/code>, 430001<\/code><\/td>142<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                            \u8a3b\uff1aCisco Syslog \u8a0a\u606f\u4ee3\u78bc\u53c3\u8003\uff1a<\/em><\/p>\n\n\n\n
                              \n
                            • 113015<\/code>: ISE 802.1X \u8a8d\u8b49\u6210\u529f (SGT: Contractors, Value: 15)<\/li>\n\n\n\n
                            • 430001<\/code>: Snort 3 \u89f8\u767c MALWARE-CNC Win.Trojan.CobaltStrike beacon detected<\/code><\/li>\n<\/ul>\n\n\n\n
                              \u554f\u984c\u8207\u4efb\u52d9<\/p>\n\n\n\n
                                \n
                              1. \u653b\u64ca\u4e3b\u6a5f\u7684 IP \u8207\u95dc\u806f\u7684 AD \u5e33\u865f\u70ba\u4f55\uff1f<\/li>\n\n\n\n
                              2. \u70ba\u4e86\u5728\u4e0d\u66f4\u63db\u4ea4\u63db\u6a5f\u9023\u63a5\u57e0\u7684\u60c5\u6cc1\u4e0b\u7acb\u5373\u963b\u65b7\u8a72\u4e3b\u6a5f\u7684\u6240\u6709\u5167\u90e8\u6a6b\u5411\u9023\u7dda\uff0c\u8003\u751f\u61c9\u5728 ISE \u4e0a\u547c\u53eb\u4f55\u7a2e\u6a5f\u5236\uff1f\u8acb\u5217\u51fa\u5177\u9ad4\u914d\u7f6e\u8def\u5f91\u3002<\/li>\n<\/ol>\n\n\n\n
                                \u7b54\u6848\u8207\u5b98\u65b9\u89e3\u984c\u908f\u8f2f<\/p>\n\n\n\n
                                  \n
                                1. \u5a01\u8105\u5b9a\u4f4d<\/strong>\uff1a\n
                                    \n
                                  • \u60e1\u610f\u4e3b\u6a5f IP \u70ba 10.10.45.88<\/code>\uff0c\u5c0d\u61c9\u5e33\u865f\u70ba\u5916\u5305\u5ee0\u5546 bob_contractor<\/code>\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                                  • ISE \u8655\u7f6e\u7b56\u7565\uff08Adaptive Network Control, ANC\uff09<\/strong>\uff1a\n
                                      \n
                                    • \u6b64\u984c\u8003\u6838\u96f6\u4fe1\u4efb\u52d5\u614b\u53cd\u61c9\u6a5f\u5236\u3002\u6700\u5feb\u4e14\u7b26\u5408\u5fae\u9694\u96e2\u539f\u5247\u7684\u624b\u6bb5\u662f\u900f\u904e ISE ANC\uff08\u81ea\u9069\u61c9\u7db2\u8def\u63a7\u5236\uff09<\/strong> \u9032\u884c\u9694\u96e2\uff0c\u800c\u975e\u624b\u52d5\u53bb\u4ea4\u63db\u6a5f shut \u57e0\u6216\u91cd\u958b\u6a5f\u3002<\/li>\n\n\n\n
                                    • \u5177\u9ad4\u8655\u7f6e\u6d41\u7a0b<\/strong>\uff1a\n
                                        \n
                                      1. \u767b\u5165 ISE\uff0c\u5c0e\u822a\u81f3\uff1aOperations > Adaptive Network Control > Policy List<\/code>\uff0c\u78ba\u8a8d\u5df2\u5efa\u7acb\u540d\u70ba Quarantine<\/code> \u7684 ANC \u7b56\u7565\uff08\u52d5\u4f5c\u6307\u6d3e\u70ba SGT \u9694\u96e2\u6216 Quarantine dACL\uff09\u3002<\/li>\n\n\n\n
                                      2. \u524d\u5f80 Operations > Live Sessions<\/code> \u6216 ANC Endpoint Operations<\/code>\u3002<\/li>\n\n\n\n
                                      3. \u627e\u5230 IP 10.10.45.88<\/code>\uff08\u6216\u5c0d\u61c9 MAC \u5730\u5740\uff09\uff0c\u5728\u52d5\u4f5c\u9078\u55ae\u4e2d\u9078\u53d6 Apply ANC Policy<\/strong>\u3002<\/li>\n\n\n\n
                                      4. \u9078\u64c7\u7b56\u7565 Quarantine<\/code> \u4e26\u5957\u7528\u3002<\/li>\n\n\n\n
                                      5. ISE \u5c07\u7acb\u5373\u5411\u908a\u7de3\u63a5\u5165\u4ea4\u63db\u6a5f\u767c\u9001 RADIUS CoA\uff08Change of Authorization, RFC 5176\uff09<\/strong>\uff0c\u52d5\u614b\u5207\u63db\u9023\u63a5\u57e0\u6388\u6b0a\uff0c\u5c07\u8a72\u4e3b\u6a5f\u9650\u5236\u5728\u4fee\u88dc\/\u9694\u96e2\u5b89\u5168\u7d44\u4e2d\uff0c\u963b\u65b7\u5176\u5411\u5176\u4ed6\u4f3a\u670d\u5668\u5b58\u53d6\u3002<\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                                        \u4e09\u3001 \u8003\u5834\u91cd\u9ede\u63d0\u793a<\/p>\n\n\n\n
                                          \n
                                        1. \u8a8d\u8b49\u4ee3\u78bc\u8981\u654f\u92b3<\/strong>\uff1a\u8003\u984c\u82e5\u63d0\u4f9b Raw Syslog\uff0c\u770b\u5230 111008<\/code>\u3001113015<\/code>\uff08ISE \u8a8d\u8b49\u65e5\u8a8c\uff09\u6216 106015<\/code>\u3001430001<\/code>\uff08FTD \u62d2\u7d55\/\u5165\u4fb5\u65e5\u8a8c\uff09\u6642\uff0c\u8981\u80fd\u76f4\u89ba\u53cd\u61c9\u5176\u542b\u7fa9\u3002<\/li>\n\n\n\n
                                        2. \u7559\u610f\u6642\u9593\u540c\u6b65\uff08NTP\uff09<\/strong>\uff1a\u5728\u6a21\u64ec\u591a\u7cfb\u7d71\u806f\u52d5\u7684\u74b0\u5883\u4e2d\uff0c\u82e5\u984c\u76ee\u63d0\u5230\u300cSplunk \u67e5\u8a62\u4e0d\u5230\u6700\u65b0\u65e5\u8a8c\u300d\u6216\u300cpxGrid TLS \u63e1\u624b\u5931\u6557\u300d\uff0c\u7b2c\u4e00\u6b65\u6aa2\u67e5 ISE\u3001FMC \u8207 Splunk \u4e09\u8005\u7684\u7cfb\u7d71\u6642\u9593\u662f\u5426\u4e00\u81f4\u3002\u6642\u9593\u504f\u5dee\u8d85\u904e 5 \u5206\u9418\u6703\u76f4\u63a5\u7834\u58de TLS \u6191\u8b49\u9a57\u8b49\u8207 Splunk \u4e8b\u4ef6\u7684\u6642\u9593\u6233\u7d22\u5f15\u3002<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
                                          \u5728 Cisco 350-701 SCOR v2.0 \u7684\u5be6\u6a5f\u60c5\u5883\u8207\u9ad8\u968e\u6392\u932f\u984c\u4e2d\uff0c\u300cISE + pxGrid + FTD + Splunk\u300d \u69cb\u6210\u4e86\u73fe\u4ee3\u4f01\u696d\u96f6\u4fe1\u4efb\u52d5\u614b\u9632\u79a6\u7684\u9ec3\u91d1\u4e09\u89d2\uff1a \u7576\u6b64\u806f\u52d5\u93c8\u8def\u767c\u751f\u6545\u969c\u6642\uff0c\u901a\u5e38\u6703\u5c0e\u81f4\uff1a \u4e00\u3001 \u5e38\u898b\u6545\u969c\u9ede\u6392\u932f\u6b65\u9a5f\uff08Troubleshooting Workflow\uff09 1. Cisco ISE \u8207 FMC\/FTD \u7684 pxGrid \u901a\u8a0a\u5931\u6557 FTD \u4f9d\u8cf4 FMC \u900f\u904e pxGrid\uff08Port 8910 \/ WebSocket REST\uff09 \u5411 ISE \u8a02\u95b1 Session Directory\uff08IP-to-User \/ IP-to-SGT \u6620\u5c04\uff09\u3002 2. ISE \u8207 FTD \u5230 Splunk \u7684\u65e5\u8a8c\u9001\u51fa\u7570\u5e38 \u4e8c\u3001 \u8a8d\u8b49\u5be6\u6a5f\u8003\u984c\u7bc4\u4f8b\u8207\u6df1\u5ea6\u89e3\u6790 \u3010\u5be6\u6a5f\u60c5\u5883\u984c 1\uff1aFTD \u8eab\u5206\u578b\u5b58\u53d6\u63a7\u5236\u5931\u6548\u3011 \u984c\u76ee\u80cc\u666f […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14147","post","type-post","status-publish","format-standard","hentry","category-killtest"],"_links":{"self":[{"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/14147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14147"}],"version-history":[{"count":1,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/14147\/revisions"}],"predecessor-version":[{"id":14148,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/14147\/revisions\/14148"}],"wp:attachment":[{"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.killtest.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}