topic Re: ISE Live Log Discrepancies vs RADIUS Auth Reports in Network Access Control

ISE Live Log Discrepancies vs RADIUS Auth Reports

paul — Thu, 12 Oct 2017 13:34:14 GMT

In the Live Logs I see the following with all the Dot1x failures for a particular MAC address:

When I run a RADIUS authentication report for the same MAC address I don't see the failures:

The only failure you see in the report is a dynamic authorization failure. Why am I not getting an accurate reporting of what happened for this MAC address? This is in ISE 2.3. This may have always been the case as I usually deal with Live Logs only when troubleshooting issues.

Re: ISE Live Log Discrepancies vs RADIUS Auth Reports

gbekmezi-DD — Thu, 12 Oct 2017 13:50:04 GMT

Weird. Actually nothing correlates between the report and the livelog. Even the successful auth isn’t the one in your livelog but the report time range should have included it.

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

Re: ISE Live Log Discrepancies vs RADIUS Auth Reports

paul — Thu, 12 Oct 2017 13:55:17 GMT

The success is there in the live logs. Blue records don't get reported in the RADIUS reports only green/red. So once a day you will see a green record for a MAC in the reports even if it has a 100 report blue records.

Re: ISE Live Log Discrepancies vs RADIUS Auth Reports

paul — Thu, 12 Oct 2017 14:24:53 GMT

Okay I think I had a revelation on what I am seeing. The failures in the Live Log are EAP abandoned sessions so “technically” while the process is failing in the authentication step it is not really failing authentication because it never gets to doing true authentication. So maybe only true authentication failures qualify for the RADIUS authentication report.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

Re: ISE Live Log Discrepancies vs RADIUS Auth Reports

hslai — Thu, 12 Oct 2017 14:43:07 GMT

Check RADIUS Errors and Misconfigured Supplicants reports under Diagnostics. IIRC we keep them separate as they got purged more often (5 days or so).

Re: ISE Live Log Discrepancies vs RADIUS Auth Reports

paul — Thu, 12 Oct 2017 14:51:18 GMT

Yep they show up perfectly in the RADIUS Errors report. Thanks Hsing!

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250