topic Re: Persistence of failed endpoints/abandoned eap session between PSNs of the same Node group in Network Access Control

Persistence of failed endpoints/abandoned eap session between PSNs of the same Node group

umahar — Fri, 03 Mar 2017 15:11:11 GMT

We are doing some testing with F5 and PSNs.

Endpoint is abandoning eap sessions on one PSNs.

We clear the endpoint sessions on ISE Live sessions and also the persistence record on the PSN.

The F5 now sends the radius requests to the second on the same node group.

It seems that there is some stale entry on the PSNs in the same node group and the new PSN is rejecting this new radius request thinking that it already has a session.

Re: Persistence of failed endpoints/abandoned eap session between PSNs of the same Node group

umahar — Fri, 03 Mar 2017 15:44:50 GMT

We are seeing this error on the second PSN

Re: Persistence of failed endpoints/abandoned eap session between PSNs of the same Node group

hslai — Mon, 06 Mar 2017 17:58:36 GMT

Please ensure the sessions also cleared on the NAD. Then, enable the debug as recommended in the resolution. It would also help to perform packet captures.

When a new RADIUS auth request comes into ISE, it has no Class attribute. Once ISE processes it, it gives Class attribute in the response and then NAD will use it subsequently as a means to tell ISE to continue with the same conversation. If ISE receives a RADIUS request with Class attribute but it does not have the session, it would respond with this error.

ISE node groups are used for the sessions in pending state (e.g. CWA or Posture) and ISE profiling. They have no influence on this matter.

Re: Persistence of failed endpoints/abandoned eap session between PSNs of the same Node group

sofitapaul — Thu, 09 Mar 2017 06:34:58 GMT

This is perfect, thanks for your post. @hslai