topic You are most welcome! Let us in Network Access Control

Changing Re Authentication timeout : Pros & Cons

LudovicDS — Mon, 11 Mar 2019 07:14:13 GMT

Hi All,

We are expecting to change Re authentication timeout (Wireless Authentication) in a large deployment of ISE. From 3600 sec by default to 4 hours or 24 hours.

In both case 4h or 24h.

Do you see any restrictions on doing so ?

What can be the pros and the cons by changing re Authentication timeout?

Thank you very much for your answers.

Best regards.

Ludovic

Hi,

Gagandeep Singh — Wed, 16 Nov 2016 23:08:50 GMT

Hi,

Check with Reauthentication section. Will give you better idea.

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-605524.html#wp9000518

Regards

Gagan

rate if it helps!!!!

Be considerate of the logging

Tarik Admani — Wed, 16 Nov 2016 23:18:10 GMT

Be considerate of the logging (radius accounting messages) and load (authentication protocol, identity store, eap-tls if used and the key length..etc) since this is a large deployment, you may want to consider centralizing this in ISE by using the session-timeout function.

What is the use case around reducing the reauthentication interval?

Consider redirections if they are a part of your policies..etc.

Thanks,

The purpose is just to reduce

LudovicDS — Wed, 01 Feb 2017 18:35:53 GMT

The purpose is just to reduce logs .

No redirection to consider on this case.

Regards

It is best practice to

nspasov — Wed, 01 Feb 2017 19:05:56 GMT

It is best practice to increase the authentication timer in order to reduce logs. However, that also decreases your security since devices/users are challenged less frequently. Thus, you run into a potential situation that a terminated user might still have access to your network. With that said, you should have a proper termination check list where the user/device is properly deleted/disabled and CoA issued 🙂

So in summary:

Higher timer = Lower logs amount and security

Lower timer = Higher logs amount and security

I hope this helps!

Thank you for rating helpful posts!

Yes it helps Neno.

LudovicDS — Mon, 06 Feb 2017 11:51:15 GMT

Yes it helps Neno.

Thank you very much for your answer.

regards

You are most welcome! Let us

nspasov — Mon, 06 Feb 2017 22:49:46 GMT

You are most welcome! Let us know if you have any additional questions/concerns. If not, then you should mark the thread as "answered" 🙂

Neno

How can i do that Neno?

LudovicDS — Tue, 07 Feb 2017 11:41:05 GMT

How can i do that Neno?

You should be seeing a

nspasov — Tue, 07 Feb 2017 18:45:27 GMT

You should be seeing a "Correct Answer" button under each reply. Click that button under the reply that you found most useful. Also, you can mark multiple answers as "correct."