topic Re: Session-timeout on ISE 2.2 in Network Access Control

Session-timeout on ISE 2.2

Mady — Fri, 21 Feb 2020 18:35:31 GMT

I'm looking for session-timeout attribute on ISE 2.2. When I checked on attributes>Radius, I can't find that attribute.

I want to enable it because there are users which are disconnected randomly on wireless connection though we already set WLAN>Advanced>Enable Session timeout as 28800.

What I found was on AuthZ profile Re-authenticate check box.

Does the Radius attribute session-timeout is the same with AuthZ profile re-authenticate? If not, how can I add this session-timeout attribute on ISE?

I just want to make sure that authenticated users will have session of 28800 and will not be disconnected.

Thanks in advance!

Re: Session-timeout on ISE 2.2

agrissimanis — Wed, 04 Oct 2017 08:47:06 GMT

AuthZ profile re-authenticate is the same as "Enable Session Timeout" on WLC. Just make sure you also have "Allow AAA Override" enabled on that WLAN for this to work.

There are several reasons why clients could get disconnected. Do you also have "Client user idle timeout" enabled on the WLAN?

Re: Session-timeout on ISE 2.2

Mady — Wed, 04 Oct 2017 09:07:01 GMT

Hi agrissimanis thanks for your reply! 🙂

Client idle timeout is not enabled on WLAN.

How about the session timeout on Radius attribute. I've checked on Dictionary > IETF > Radius and found that there is session timeout attrubute #27. But when I will use it on the policy, it does not appear.

Is there any config on ISE that I need to enable before using the session timeout attribute?

Re: Session-timeout on ISE 2.2

agrissimanis — Wed, 04 Oct 2017 09:34:40 GMT

You shouldn't need to do anything else to use session timeout attribute. On the Authorization profile that is assigned to the affected users, select "Reauthentication" checkbox and enter the value in seconds. You should also be able to specify it manually from the "Advanced attributes settings" section of the authorization profile, select "Radius:Session-Timeout". The result will be the same.

Then in the "Attributes details" section you will see currently configured attributes that will be sent to the WLC.

In the WLC you can then go to the Monitor -> Clients section, select the client, and look at the "Re-authentication timeout" value assigned to the client.

Re: Session-timeout on ISE 2.2

Arne Bier — Wed, 04 Oct 2017 23:32:36 GMT

On the subject of setting a custom Session-Timeout in the Authorization profile, has anyone else noticed that in the Results sent to the NAS, ISE has a cosmetic bug and things the Session-Timeout is in milliseconds?

This is a cosmetic bug because the radius attribute is correctly interpreted by the NAS in seconds, therefore the operation is not impacted. I have raised this as a TAC case ages ago - no bug has been filed as yet.