topic ISE - IOS bug! in Network Access Control

ISE - IOS bug!

sudheere — Mon, 11 Mar 2019 04:07:41 GMT

I am using a stange issue in my environment. I use ISE 1.2 fo as radius server for device management/authentication(Not NAC usage). I am having Cisco c6509E VSS as core device. The device was added to ISE and aaa auth was working fine. I changed IP address of switch during my DC migration. Since then AAA fail for thsi device. ISE report and TCPdump shows old IP. My wireshard capture(SPAN port) also showing old IP in packet header irrespective of radius source interface I use in switch. Debug (radius/aaa) output in switch showing the correct interface addres whcih I use in 'ip radius source-interface'.

Unfortunatly I am unable to restart switch as it is core device in a critical place. It looks like a stange IOS issue. Did any one faced this kind of issues? Please advise how to resolve without restart. Don't know why the switch is always using its old IP to frame radius packet.

ISE - IOS bug!

Kevin P Sheahan — Mon, 25 Nov 2013 16:59:11 GMT

Check the following:

Radius source interface on the 6k matches ISE NAD IP for 6k
ISE NAD IP was changed when IP on 6k changed
Route/Connectivity to/from ISE/6k.

Kind Regards,

Kevin Sheahan, CCIE # 41349 (Security)

ISE - IOS bug!

sudheere — Tue, 26 Nov 2013 14:58:58 GMT

These have been virified. I tried difference source interfaces and even changed MAC addresses of SVIs. I am sniffing interface of ISE appliance to capture radius packets. I wondering how C6509E switch can frame a IP packet with source address not belonging to it. MAC address belongs to the switch but source IP address not belonging to the switch(Its old IP address).

ISE - IOS bug!

sudheere — Tue, 26 Nov 2013 15:00:51 GMT

I cleared all all aaa/radius related configuration and reconfigured again but probelm remains.

ISE - IOS bug!

xxkozxx — Tue, 26 Nov 2013 20:50:31 GMT

Did you change the ip of the device in your ISE configuration under Administration > Network Devices?

ISE - IOS bug!

Tarik Admani — Sun, 01 Dec 2013 06:03:11 GMT

What version of code are you running? Also when issue a "debug radius authentication" do you see any errors when pulling the new ip address? Also if you are using radius server groups did you change the source interface under the group configuration also?

Tarik Admani
*Please rate helpful posts*

ISE - IOS bug!

Javier Henderson — Tue, 03 Dec 2013 20:36:22 GMT

Try removing and re-adding the AAA configuration to the switch, to see if that will make the RADIUS service pick the right source interface.