topic Active Endpoint Counter in Network Access Control

Active Endpoint Counter

AndreaTornaghi — Mon, 27 Mar 2017 12:25:44 GMT

Hi,

we are deploying a new PoC enviroment and we are running in a strange problem. It seems that counter for the active endpoints is not incrementing.

Scenario:

3 nodes of ISE in PAN failover running version 2.2 and an external web server with the scope to create guest user using API integration.

When the guest user is authenticated from guest DB on ISE, we are able to see the authentication session on ISE from "Operation --> Radius --> Live Logs and Live Session", but under "Context Visibility -- Endpoints -- Authentication" all endpoints are in disconnected or null status.

I can also see that the session status in Live session tab is always setted in "Started" or "Terminated" value.

Is anybody experiencing the same our problem? Is status session correct or we should have different value?

Best Regards

Andrea Tornaghi

Re: Active Endpoint Counter

thomas — Tue, 28 Mar 2017 14:30:01 GMT

RADIUS Accounting is how ISE tracks the sessions and performs licensing counts.

I suspect that you are not sending RADIUS Accounting information from your NADs to ISE.

aaa accounting dot1x default start-stop group ISE-Group

Please see our How To: Universal IOS Switch Config for ISE under ISE Design & Integration Guides for the full details about how to configure AAA Accounting on a switch with ISE.

IF it persists, verify you are using a validated version of NAD software from the Cisco Identity Services Engine Network Component Compatibility, Release 2.2 - Cisco

Re: Active Endpoint Counter

AndreaTornaghi — Tue, 28 Mar 2017 16:43:06 GMT

if, on ISE, I go in Operations -- Reports -- Endpoint and Users -- RADIUS Accounting I am able to see some logs from Accounting process (you can find an example below).

My NAD is WLC 5508 running version 8.2.130, and on SSID I have configured as accounting servers all PSN nodes in the same order of authentication servers.

I checked also that Accounting is enabled in Logging Categories List and it is collecting logs from LogCollector and LogCollector2.

Ex.

11004 Received RADIUS Accounting-Request

11017 RADIUS created a new session

15049 Evaluating Policy Group

15008 Evaluating Service Selection Policy

15004 Matched rule

22083 User/group session counters incremented on accounting start

11005 Returned RADIUS Accounting-Response

Re: Active Endpoint Counter

Craig Hyps — Tue, 28 Mar 2017 20:27:17 GMT

Be sure to enable the RADIUS Server Accounting > Interim Update checkbox but set Interim Interval to 0.

Re: Active Endpoint Counter

AndreaTornaghi — Wed, 29 Mar 2017 11:33:48 GMT

Chyps, you answer is correct. The problem was on WLC side. I enabled the RADIUS Server Accounting Interim update and everything is working fine.

Re: Active Endpoint Counter

gbekmezi-DD — Thu, 30 Mar 2017 17:07:02 GMT

Craig doesn’t need to be told when he is right…it’s just assumed .

Re: Active Endpoint Counter

lkajcsu01 — Tue, 02 Oct 2018 12:01:08 GMT

Hello Gents,

Got exactly the same problem.

My WLC is 8.0.152 and there is no indication for RADIUS>Accounting there will be any Interim Update checkbox. Might my firmware to old, what do you think ?

Regards,

lkajcsu01

Re: Active Endpoint Counter

howon — Tue, 02 Oct 2018 14:10:11 GMT

The interim accounting setting is under each WLAN. Go to WLAN -> Select WLAN and edit -> Security -> AAA Servers.

Re: Active Endpoint Counter

jayage — Mon, 25 Feb 2019 16:24:51 GMT

Hi Thomas,

can this command be used with Tacacs+ instead of Radius as well?

aaa accounting dot1x default start-stop group TACACS-Server-GROUP

Thank you

Jochen