topic Re: Incorrect ISE base consumption counter in Network Access Control

Incorrect ISE base consumption counter

o.tasaddaq1 — Sun, 22 Dec 2019 08:41:39 GMT

Hello Everyone,

We are using ISE 2.4 and have 500 perpetual Base license. We have not more than 500 Dot1X and MAB users and devices but it shows more than 700 base license consumption.

Any idea? Thanks

Re: Incorrect ISE base consumption counter

Mike.Cifelli — Mon, 23 Dec 2019 13:19:20 GMT

Have you enabled aaa accounting on your NADs? ISE relies on radius accounting in order to track endpoints. In your current situation you should not experience service disruptions. However, you should work towards enabling accounting services if not already enabled. Accounting stop should be sent from NADs when a session terminates which then releases the license.

Re: Incorrect ISE base consumption counter

o.tasaddaq1 — Mon, 23 Dec 2019 14:19:30 GMT

Hi Mike,

Thanks for your email. Yes, we have enabled AAA accounting on all NADs.

aaa accounting delay-start
aaa accounting nested
aaa accounting update periodic 5
aaa accounting auth-proxy default start-stop group ISE
aaa accounting dot1x default start-stop group ISE

I know that this issue won't create any service disruption but its a matter of concern.

Re: Incorrect ISE base consumption counter

Mike.Cifelli — Mon, 23 Dec 2019 15:22:17 GMT

Within ISE are you able to see any 'Terminated' session statuses under Operations->Radius->Live Sessions?