topic ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions? in Network Access Control

ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hnohre — Sun, 21 Oct 2018 17:39:36 GMT

When querying the pxGrid sessions interface I get quite a few more entries than I do from the ISE GUI interface (Live sessions).

Upon investigation, it shows that the sessions which also appear in ISE GUI interface are in state STARTED or POSTURE, whereas the sessions retrieved through pxGrid interface also includes sessions in state AUTHENTICATED.'

Many of these sessions from pxGrid that are in state AUTHENTICATED are also very old, some from 6 months back.

I believe I can (in my script) easily filter on this, but it would still be nice to have a pointer to the difference between

sessions that are kept in pxGrid, but now shown in ISE GUI (live sessions).

Re: ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hslai — Sun, 21 Oct 2018 23:22:58 GMT

It's the first I heard of such. Please see if Removing Stale Sessions helps.

Re: ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hnohre — Mon, 22 Oct 2018 21:34:47 GMT

Thanks. I am sure I can remove the stale sessions as per your suggestion.

But is there meaning of the state anywhere documented?

My guess is that the session gets AUTHENTICATED, then to STARTED after accounting start, then back to AUTHENTICATED after accounting stop, or after a timeout??

But I prefer not to guess.

Also what is the expected behaviour wrt ISE purging these sessions? Should they be purged after accounting stop, or after a timeout, or never?

Re: ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hslai — Mon, 22 Oct 2018 22:38:12 GMT

AUTHENTICATED -- after sending the access-accept.

STARTED -- after receiving ACCT start

TERMINATED -- after receiving ACCT stop

Postured -- after receiving a posture report

There are also Authenticating and Authorized but I do not think we using them any longer, because we do not recommend sending epm events via syslog from NAD to ISE M&T nodes.

Re: ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hslai — Thu, 25 Oct 2018 05:25:13 GMT

Also what is the expected behaviour wrt ISE purging these sessions? Should they be purged after accounting stop, or after a timeout, or never?

Usually accounting stop will terminate the associated session, except for roaming (nas-update). If no accounting, the sessions clear after 1 hour. If accounting received, they clear after 5 days if not further updates.

Re: ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

hslai — Sat, 27 Oct 2018 02:46:48 GMT

The aged authenticated sessions might be due to CSCvi79632.