topic Re: ISE Active Endpoints in 0 in Network Access Control

ISE Active Endpoints in 0

edisonguerrero — Wed, 03 Oct 2018 22:55:46 GMT

Hi community,

I have a dashboard ISE issue I think... The metrics about "Active Endpoints", "Rejected Endpoints", "Anomalous Behavior" and "Authenticated Guests" shows 0 in all of them. Meanwhile the "Total Endpoint" metric show over 23k as you can see in the image attached. I can see successful authentications in the Radius Live Logs either the domain users or the guest users.

If I check the "endpoints" section, the "authentications status" shows that 100% of the devices are disconnected (2nd Image) and even the base license appears consumed by almost 6k but the license is just to 2k as you can see in the 3rd image.

There are 1K users in the organization, so the numbers of "Total Endpoints" and "License Consumed" is hard to get.

What could it be? The ISE version corresponding to 2.3 patch 4.

Re: ISE Active Endpoints in 0

Cory Peterson — Wed, 03 Oct 2018 23:04:29 GMT

Do you have any live logs?

Re: ISE Active Endpoints in 0

Mohammed al Baqari — Thu, 04 Oct 2018 08:04:13 GMT

Go to context visibility > endpoints > filter with status connected. Do you
see any endpoint? Most likely it will be zero

Re: ISE Active Endpoints in 0

paul — Thu, 04 Oct 2018 11:30:08 GMT

Do you have RADIUS accounting enabled on your network devices?

Re: ISE Active Endpoints in 0

Nidhi — Thu, 04 Oct 2018 11:57:53 GMT

Can you send screenshot of live sessions from ISE

Re: ISE Active Endpoints in 0

edisonguerrero — Thu, 04 Oct 2018 13:12:17 GMT

Hi Cory,

Yes, I have live logs as you can see in the attached image...

Re: ISE Active Endpoints in 0

edisonguerrero — Thu, 04 Oct 2018 13:17:19 GMT

Hi,

With the filter "connected" doesn't appears any connected endpoint..

Re: ISE Active Endpoints in 0

edisonguerrero — Thu, 04 Oct 2018 13:21:25 GMT

Hi Paul,

Yes, it is enabled on the netowrk devices... The config about the accounting on the switch's is the next:

aaa authentication login default local
aaa authentication dot1x default group ISE-RADIUS
aaa authorization exec default local
aaa authorization network default group ISE-RADIUS
aaa accounting dot1x default start-stop group ISE-RADIUS
aaa accounting update periodic 5

Re: ISE Active Endpoints in 0

Jason Kunst — Thu, 04 Oct 2018 13:22:51 GMT

Are you sending radius accounting packets to Ise? If you’re recommend contact the tac to dig deeper

Re: ISE Active Endpoints in 0

edisonguerrero — Thu, 04 Oct 2018 13:23:31 GMT

Hi Nidhi,

Yes, I can see some live logs...

Re: ISE Active Endpoints in 0

Nidhi — Mon, 08 Oct 2018 06:53:08 GMT

I see you have accounting enabled. if you have wireless clients, enable Radius accounting from controller as well.

As Jason suggested, please open a TAC case to debug further.