https://community.cisco.com/t5/network-access-control/authentication-periodic/m-p/3994533#M455166 <P>A couple of things come to mind.&nbsp; First, from a security perspective, someone could use a hub or other device that keeps the link state of the port up and is able to plug a rogue device in after the good device authenticates.&nbsp; Then the rogue device would have access seemingly for a long period of time without having to reauthenticate.&nbsp; Reauthenticating at least every 12 hours may not stop this activity but would cause the rogue actor some headaches.</P><P>Second, for visibility, troubleshooting, and/or reporting, you may miss some devices if they haven't authenticated in the previous day or so.&nbsp; ISE Live Logs only go back for 24 hours.&nbsp; And some of the reporting gets slow if you try to go back more than 7 days.&nbsp; I personally like to be able to filter on an IP, MAC address, or username/machine name to be able to see whether someone is online and what switch/port they are on.&nbsp; You wouldn't be able to trust the Live Logs if you aren't sure if they authenticated recently or not.</P> Fri, 06 Dec 2019 02:27:56 GMT Colby LeMaire 2019-12-06T02:27:56Z https://community.cisco.com/t5/network-access-control/authentication-periodic/m-p/3994386#M455164 <P>I had a couple of questions regarding authentication periodic.</P><P>If you do not have authentication periodic configured on a switch port, does that mean a device will only have to authenticate 1 time until the inactivity timer expires?</P><P>Would it be a bad practice to only authenticate devices 1 time?</P> Thu, 05 Dec 2019 19:50:15 GMT https://community.cisco.com/t5/network-access-control/authentication-periodic/m-p/3994386#M455164 Alex Pfeil 2019-12-05T19:50:15Z https://community.cisco.com/t5/network-access-control/authentication-periodic/m-p/3994533#M455166 <P>A couple of things come to mind.&nbsp; First, from a security perspective, someone could use a hub or other device that keeps the link state of the port up and is able to plug a rogue device in after the good device authenticates.&nbsp; Then the rogue device would have access seemingly for a long period of time without having to reauthenticate.&nbsp; Reauthenticating at least every 12 hours may not stop this activity but would cause the rogue actor some headaches.</P><P>Second, for visibility, troubleshooting, and/or reporting, you may miss some devices if they haven't authenticated in the previous day or so.&nbsp; ISE Live Logs only go back for 24 hours.&nbsp; And some of the reporting gets slow if you try to go back more than 7 days.&nbsp; I personally like to be able to filter on an IP, MAC address, or username/machine name to be able to see whether someone is online and what switch/port they are on.&nbsp; You wouldn't be able to trust the Live Logs if you aren't sure if they authenticated recently or not.</P> Fri, 06 Dec 2019 02:27:56 GMT https://community.cisco.com/t5/network-access-control/authentication-periodic/m-p/3994533#M455166 Colby LeMaire 2019-12-06T02:27:56Z