topic Re: Current behavior of endpoint purge in ISE 2.3 in Network Access Control

Current behavior of endpoint purge in ISE 2.3

lburleso — Mon, 07 Aug 2017 21:01:26 GMT

We are running base license only and have been bit in the past by the Endpoint Purge feature, as it was only effective when running profiling.

We recently upgraded to v2.3 and are wondering if Cisco was able to incorporate customer requests and improve the behavior of endpoint purge by updating static endpoints' database entries when a MAB login occurs.

We would love to be able to automatically purge out our unused endpoints.

Re: Current behavior of endpoint purge in ISE 2.3

Jason Kunst — Tue, 08 Aug 2017 17:05:58 GMT

Pleade work through tac as this is critical piece to hotspot and guest endpoint purges

mmake sure to log a defect and post here

Re: Current behavior of endpoint purge in ISE 2.3

meliux — Thu, 17 Aug 2017 22:37:18 GMT

Are there any updates to this? It looks like we're having the same issue - guest self registration with the automatic device registration option enabled (so they don't have to keep supplying credentials repeatedly)... device is supposed to be purged after 7 days but it's not getting removed.

Do we have to log a tac case too? Is there a workaround?

Re: Current behavior of endpoint purge in ISE 2.3

lburleso — Tue, 22 Aug 2017 16:37:46 GMT

SR 682923149

Will post updates

Re: Current behavior of endpoint purge in ISE 2.3

Jason Kunst — Tue, 22 Aug 2017 16:54:56 GMT

Thanks this is helpful, let us know the defect

Re: Current behavior of endpoint purge in ISE 2.3

lburleso — Fri, 25 Aug 2017 16:56:57 GMT

* Endpoint Purge seems to run even under base licensing

* Endpoint Purge seems to run even when the Profiler is turned off

* Under base licensing, Endpoint attribute "Inactive Days" only updates when Start/Stop RADIUS accounting messages are received. It will NOT update when an Interim Update message is received.

* Under Plus licensing, Endpoint attribute "Inactive Days" will update when Start/Stop/Interim RADIUS accounting messages are received.

A feature request/bug is being filed about this.

Re: Current behavior of endpoint purge in ISE 2.3

meliux — Fri, 25 Aug 2017 22:21:30 GMT

Would this also affect the "elapsed days" since registration attribute? My purge rule uses that, rather than 'inactive days', but the behavior seems to be the same.

Re: Current behavior of endpoint purge in ISE 2.3

lburleso — Mon, 28 Aug 2017 20:12:33 GMT

Bug is CSCvf75989

Should be public in a few days.

Re: Current behavior of endpoint purge in ISE 2.3

lburleso — Mon, 28 Aug 2017 20:13:37 GMT

Elapsed days is based on the creation date of the endpoint. That is why you are seeing your endpoints deleted even when active.

Re: Current behavior of endpoint purge in ISE 2.3

lburleso — Fri, 01 Sep 2017 18:31:12 GMT

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf75989