topic Re: ISE endpoints read connected in Endpoint Security

ISE endpoints read connected

joseph.williams@atos.net — Tue, 23 Jun 2020 22:14:04 GMT

This is probably a stupid question (yes there are stupid questions);

One of my staff has reported a user who we changed IDs as still reading connected when he looks at endpoints but if we look at live sessions this person is NOT live, neither is his MAC nor IP address.

WHY?

Re: ISE endpoints read connected

Marvin Rhoads — Wed, 24 Jun 2020 12:06:12 GMT

Do you have RADIUS accounting enabled on the network access devices so that there is a proper notice given to ISE when the session ends?

Also check your ISE version and patch. There have been bugs related to sessions not being released properly in the past.

Re: ISE endpoints read connected

joseph.williams@atos.net — Wed, 24 Jun 2020 18:08:23 GMT

Yes, The Live sessions properly show when a session has been terminated. The real question probably should be under endpoints. I still see this user as having a connected endpoint when I know he is not connected. Should I just purge the endpoints and have them be reestablished?