topic This is probably due to in Network Access Control

Live logs take a long time if access reject

Diarra MBENGUE — Mon, 11 Mar 2019 07:55:35 GMT

Hello,

I have a problem on ISE2.1: when I authenticate and get an access Reject by the ISE 2 or 3 times, I can't see the others rejected live logs until about 15 minutes.

Is it a normal case?

if no, is there a configuration to be made on the ISE to have live logs regarless the number of access reject?

Thank you in advance

This is probably due to

Rahul Govindan — Thu, 10 Aug 2017 14:20:47 GMT

This is probably due to Anomalous Client suppression for Radius Authentications. The reporting interval is 15 minutes when you fail multiple authentications with 5 minutes. You can disable for a particular endpoint this under live log by choosing "Bypass Client suppression". This allows you to see all authentications for 1 hour (pic attached)

Thank you for your quick

Diarra MBENGUE — Thu, 10 Aug 2017 14:40:40 GMT

Thank you for your quick answer.

I have just test it for a particular endpoint as you told me and it's ok. Now I can see all logs for this endpoint.

Have a nice day!