topic ISE authentication & accounting in Network Access Control

ISE authentication & accounting

jlaw2@cisco.com — Thu, 24 May 2018 19:47:39 GMT

Can ISE support accounting and authentication messages going to different PSN (part of the same node group) or is license count (acct start/stop) impacted?

Have an escalation from the customer who has been experiencing low license consumption. Validated that one a specific endpoint was authenticated & there was no accounting event. Customer performed packet traces and can see the PSN receiving authentication & accounting messages.

Re: ISE authentication & accounting

kthiruve — Thu, 24 May 2018 21:14:13 GMT

Hi John,

Session count is tracked using accounting starts and stops.

Here is the ordering guide that will provide further information on license consumption in Table 5.

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

That said, please continue work with TAC so not as to derail the analysis and investigation.

-Krishnan

Re: ISE authentication & accounting

Jason Kunst — Thu, 24 May 2018 21:53:07 GMT

Accounting and authentication should be sent to the same policy service node if it’s not then you’re going to get erroneous behavior