Endpoint Status

loobitize — Mon, 12 Jun 2017 19:58:43 GMT

I have a group of endpoints that MAB authenticate to the network and rarely change connection state (a/v and security endpoints). Many of these devices were showing up in ISE as "disconnected" until I added the "authenticate periodic" command at the suggestion of TAC. Now many, but not all, of the devices show up with status "connected". However, even for devices that show up as connected, there is no authentication data in the endpoint authentication tab. "Show authentication" on the switch indicates there was a successful mab authentication. Further, I am unable to issue a COA, presumably because ISE does not know about the active authentication.

Can someone explain in detail how ISE tracks endpoint connection status, the relationship to authentication, any relevant timers and the configuration required for ISE to maintain accurate connection status?

Thanks

Re: Endpoint Status

Timothy Abbott — Wed, 14 Jun 2017 21:02:59 GMT

ISE uses RADIUS accounting to maintain the state of the connection. I suggest verifying the AAA connection on the switch to ensure ISE is receiving those packets.

topic Re: Endpoint Status in Network Access Control

Endpoint Status

Re: Endpoint Status