topic Re: Cisco ISE - multiple radius live log entries for same request in Network Access Control

Cisco ISE - multiple radius live log entries for same request

nathgregory — Thu, 16 May 2019 18:12:20 GMT

Hi. I am getting a vast number of seemingly duplicate entries in the Radius Live Logs. As far as I am aware they are all for one request, and are even if it is a pass. See attached picture.

Any help would be appreciated.

The attached picture I have crossed out the username, but they are all identical.

Re: Cisco ISE - multiple radius live log entries for same request

hslai — Thu, 16 May 2019 19:58:51 GMT

I see you have ~ 11 entries within the same second.

First, go to [ ISE admin web UI > Administration > System > Logging > Remote Logging Targets ], verify only one target enabled per M&T node.

Second, monitor the RADIUS requests from the network device by TCPDUMP or Use Re: Check logs on Cisco ISE to verify only one request sent to the ISE PSN.

If neither helps, time to open a TAC case.

Re: Cisco ISE - multiple radius live log entries for same request

RaffyLindogan — Thu, 16 May 2019 23:50:21 GMT

Hi mate,

It could be that the supplicant on end device has issue.

Or if it is legit radius sessiions, then you can just suppress it by following the steps below.

1. Go to Administration/Settings/Protocols/RADIUS

2. Check "Suppress successful reports"

3. You can also check "Suppress Repeated failed clients"

Note: There are variety of settings that you can choose there depending on what you want to set

Once you've done this, the Live Logs will only show one line for specific session and it will provide the number of repeat counts.

Cheers,

Raffy

Cheers

Re: Cisco ISE - multiple radius live log entries for same request

nathgregory — Fri, 17 May 2019 09:48:17 GMT

Hi. TCPDump shows only one Radius request being sent.

Why would it show multiple times in the logs though?

Re: Cisco ISE - multiple radius live log entries for same request

nathgregory — Fri, 17 May 2019 09:48:58 GMT

Thanks. Only one Radius request was sent, but it is already selected to Suppress Succcessfull Reports. Strange.

Re: Cisco ISE - multiple radius live log entries for same request

RaffyLindogan — Fri, 17 May 2019 12:13:22 GMT

Hi mate,

if it is one endpoint/user causing that then it could be issue on supplicant.

you can update driver of supplicant.

It doesnt explain though why it would appear on separate sessions if suppression for both failed and successful connections is enabled.

cheers,

Raffy

Re: Cisco ISE - multiple radius live log entries for same request

nathgregory — Fri, 17 May 2019 12:27:42 GMT

A packet dump confirmed only on radius request was made from the supplicant to ISE.

I don't have the issue with other network devices though, just the 2700 autonomous Access Point.

Re: Cisco ISE - multiple radius live log entries for same request

hslai — Sat, 18 May 2019 03:16:49 GMT

ISE is not restricting to use the same host in multiple logging targets.

If this is not your issue, please engage TAC.