topic Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"? in Network Access Control

Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

getaway51 — Thu, 17 Oct 2019 01:02:13 GMT

Hi,

Is the password for this CLI "automate-tester username dummy probe-on" needed?

radius server ise

automate-tester username dummy probe-on

key testise

Is "key testise" related to automate-tester username dummy probe-on?

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

Damien Miller — Thu, 17 Oct 2019 02:31:30 GMT

"dummy" in the "automate-tester username dummy probe-on" command is an administrator defined username, dummy can be replaced with anything. The user does not need to exist anywhere, the switch is perfectly fine with ISE sending a radius-reject back in response to the probe.

"key testise" is the radius shared secret that the switch uses to communicate with ISE. You set the key "testise" to anything you want, but it has to match on the network device configured within the ISE GUI.

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

getaway51 — Thu, 17 Oct 2019 07:45:54 GMT

Hi,

So this "dummy" is not a username configured in ISE. Basically "dummy" is going to fail.

But the key needs to be correct same like in ISE.

AM i correct?

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

getaway51 — Tue, 22 Oct 2019 13:26:39 GMT

Hi,

If I check the username dummy(by filter) in the ISE live logs, can I see the failed session for user "dummy"?

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

paul — Thu, 24 Oct 2019 14:38:00 GMT

By default ISE will not disclose invalid usernames in the RADIUS logs. You can turn that annoying feature off in the RADIUS settings in ISE. As Damien said ISE can reject the authentication and the switch won't care as long as it is getting a response.

I usually setup a policy set for the switch keep alives as I don't like not handling the request properly. I set the authentication to internal user and set the user not found to Continue. Then I put in an authorization rule to allow the access with a deny all DACL. Once I see the successful hits in the RADIUS logs I turn on suppression for the User ID so the switch probes aren't filling up my logs.

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

fhowzejr2 — Tue, 26 May 2020 19:00:26 GMT

Is it possible to share your authentication and authorization rules in your policy set? I would like to do this as the "Invalid" errors is filling up the Live logs.

Thanks

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

paul — Tue, 26 May 2020 19:29:58 GMT

Skip the policy set and just go to Administration->System->Logging->Collection Filters and setup a new collection filter to Filter All for the username "dummy" or whatever you are using for your switch keep-alive probes.

Re: Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

fhowzejr2 — Tue, 26 May 2020 20:32:22 GMT

Thanks so much, I applied the collection filter and no longer have the clutter in Live Logs.