1 Reply Latest reply on May 10, 2016 1:02 AM by jtuazon

    Using LEM for 802.1x alerting

    jtuazon

      Hi all,

       

      Just curious if any here on thwack have used the LEM to alert on 802.1x violations (via a custom rule). I have a case open with support but they can't seem to find it.

      This is a bit tricky as the violation relies on two events:

      DOT1X-5-FAIL

      MAB-5-FAIL

      These two events must be triggered by the same MAC address. I also tried looking for a single syslog event on the switches for this, but to no avail.

       

      Thanks all.