topic Re: ISE Reauthentication in Network Access Control

ISE Reauthentication

Ufuk Gudulluoglu — Thu, 14 Dec 2017 15:29:30 GMT

Hello,

Is there a way to randomise the time for the reauthentication for ISE clients? When we select "Reauthentication" in the authorization profile it asks me an exact time in seconds to do the reauthentication. If possible, I would like to enter a range of time with min and max values, and ISE can select a random time from that range for each client.

My aim is to distribute the load on ISE to a wide range of time. Currently, in the morning all of the clients are logging in approximately in half an hour then after the reauthentication time same thing goes on again in half an hour. It would be great to widen this time to an hour or a couple of hours.

Regards,

Re: ISE Reauthentication

Jason Kunst — Thu, 14 Dec 2017 16:08:58 GMT

There is no feature and don't really see the need.

From our SME hslai Human nature is a great random factor. 😉

In case it’s robotic logins, setting this re-auth timers randomly in ISE authorization profiles can only help reauth.

Anyhow, reauth every 1/2 hour is too often. I believe our recommendation is every 3 or 4 days.

Re: ISE Reauthentication

Craig Hyps — Thu, 14 Dec 2017 16:58:13 GMT

Recommended reauth / session timeout value is 2 hours. To Jason's point, you typically do not need to reauth very often. Idle timeouts are typically used to detect cases where user no longer present, especially if clients not directly connecting to switchport. If directly connected, then typically no reason to reauth until disconnect and reconnect, and this happens automatically. You may want to compromise and set reauth to 1/day with RADIUS Accounting updates being sent every 2-3 days to keep session status updated in ISE.

Craig