topic Cisco ISE Radius Live log is empty in Network Access Control

Cisco ISE Radius Live log is empty

ccna_security — Mon, 13 Apr 2020 10:19:59 GMT

Dear all. i have created lab envirement on eve-ng and trying to learn cisco ise. i configured switch as below

aaa new-model
!
!
aaa group server radius ISE
server name ISE01
ip radius source-interface Vlan1
!
aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa accounting update newinfo periodic 2880

interface vlan 1

ip address 10.10.10.100 255.255.255.0

radius server ISE01

address ipv4 10.10.10.20 auth-port 1812 acct-port 1813

key cisco

Then tested using command shown below. But unfortunatelly nothing shown on Radius Live logs. i choose network device as default and enabled it with Radius key. Could you please instruct me to configure switch that cause logs not to be shown on radius live logs?

Switch#test aaa group radius test-user test-password new-code
User rejected

Re: Cisco ISE Radius Live log is empty

Aditya Ganjoo — Mon, 13 Apr 2020 13:35:22 GMT

Uncheck Radius suppression on ISE and then check:

https://community.cisco.com/t5/security-documents/configuring-anomalous-client-suppression-on-ise/ta-p/3161437

Re: Cisco ISE Radius Live log is empty

ccna_security — Tue, 14 Apr 2020 13:01:00 GMT

Thanks Aditya .just give me a minute to test it and turn you back. one more think i want to ask. do you think the configuration is enough that logs to be displayed on Radius live logs? let me inform you that i have not configured switch interface yet

Re: Cisco ISE Radius Live log is empty

ccna_security — Tue, 14 Apr 2020 13:10:56 GMT

i tested as you said but nothing shown o Radius live logs. do you have other option?

Re: Cisco ISE Radius Live log is empty

Darkmatter — Tue, 14 Apr 2020 21:18:19 GMT

And your ISE has an interface with ip address 10.10.10.20 configured? Just checking to be sure ...

You could take a TCP dump on the ISE to see if any RADIUS packets are arriving anyway, on the switch side you could do the same to see of your RADIUS packets are leaving the device.

Re: Cisco ISE Radius Live log is empty

ccna_security — Wed, 15 Apr 2020 03:40:20 GMT

You mean i must use thirparty packet analyser tool or cisco ise has its own packet capture tool? If it has own, could you please show me the command

Yesterday i downloaded version 2.6.0 and tried once more. Tested aaa then logs appeared on Radius live log. I think the old version of ise has bug thats why i faced the issue. The problem tha i faced was on version 2.0

Re: Cisco ISE Radius Live log is empty

Anurag Sharma — Wed, 15 Apr 2020 06:58:46 GMT

Hi @ccna_security ,

ISE has a nice tool on the GUI to take captures for any device (talking directly to ISE). This will give you unencrypted captures so, please be aware of any sensitive information such as passwords.

Re: Cisco ISE Radius Live log is empty

ccna_security — Wed, 15 Apr 2020 07:27:41 GMT

Thanks Anurag. I will test it as well

Re: Cisco ISE Radius Live log is empty

poongarg — Wed, 15 Apr 2020 07:51:14 GMT

Hi,

So you want to see this failed authentication attempt in RADIUS live logs right.

What is the ISE software version and patch you are using. If you are not able to see live logs completely or just this request is not shown up.

If the authentication report shows this attempt.

Also if the ISE Node is standalone.

Regards,

Poonam Garg

Re: Cisco ISE Radius Live log is empty

ccna_security — Wed, 15 Apr 2020 19:35:48 GMT

Dear Poonam

I installed cisco 2.0 version on my laptop using vmware. When i look radius live logs non of the event shown there. As if it is not sync with switch. I downloaded ise 2.6 version and installed it on vmware and tested it for the first time and looked at radius live logs. Finally i saw authentication failure log on radius live log. I turned the ise off and on after 2 days later, this time application server get stuck by writing initializing. I am fed up with ise. Tons of article waits me to read but i haven't installed ise virual machine yet((

Re: Cisco ISE Radius Live log is empty

poongarg — Thu, 16 Apr 2020 00:36:50 GMT

Hi,

There are couple of live logs related issues fixed in latest releases. To understand the issue why live logs not showing up on 2.0, I need collector.log on the MNT and prrt-server.log on the PSN (in your case, I believe both persona are on one node).

Regarding ISE 2.6, it takes time for the application server process to come into running state from initializing after you power on the VM. If the process is still in initializing state then please check if the VM is provisioned with the recommended resources for ISE 2.6.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/install_guide/b_ise_InstallationGuide26/b_ise_InstallationGuide_26_chapter_01.html

Re: Cisco ISE Radius Live log is empty

ccna_security — Thu, 16 Apr 2020 09:28:32 GMT

hello all. i captured tcp packets and added screenshot. as you see on screenshot switch(10.10.10.100) sends access-request to ise(10.10.10.10) but logs not appears on Radius Live LOgs.

Re: Cisco ISE Radius Live log is empty

ccna_security — Thu, 16 Apr 2020 09:40:03 GMT

could you please instruct me to collect log that you need to troubleshoot?

Re: Cisco ISE Radius Live log is empty

poongarg — Thu, 16 Apr 2020 10:57:59 GMT

Software maintenance support for 2.0 and 2.0.x software releases end on March 17^th 2020. No patches or maintenance releases will be provided for ISE 2.0 and 2.0.X releases after that date.

I would suggest you, instead of troubleshooting on ISE 2.0 version, focus on ISE 2.6 which is also marked as star release by Cisco with latest patch 6 installed on it as I believe you are working in your test environment.

-Let me know if you are still facing live log issue on ISE 2.6P6.

Re: Cisco ISE Radius Live log is empty

ccna_security — Thu, 16 Apr 2020 13:07:56 GMT

As i said i installed ise 2.6 version and gave virtual machine 4 gb ram, 4 cpu. This version has no any radius logs issue. But this version most time keep initializing application server wont change to running state.

Re: Cisco ISE Radius Live log is empty

poongarg — Thu, 16 Apr 2020 14:21:07 GMT

CPU allocation is fine for evaluation mode but the minimum memory need to be 16 GB to prevent this issue. Alternatively you can use below ova image for your testing directly instead of allocating the resources manually.

ISE-2.6.0.156-virtual-SNS3615-SNS3655-200.ova

https://software.cisco.com/download/home/283801620/type/283802505/release/2.6.0

Re: Cisco ISE Radius Live log is empty

ccna_security — Thu, 16 Apr 2020 14:29:16 GMT

That is the one i have installed. If i increased ram to 16 gb dont you think other virtual machines would work slowly? I have computer with 16 gb ram. i use windows 7, windows server CA, and Cisco ISE. do you think by increasing ISE's ram wouldnt affect other machines rapidity?

Re: Cisco ISE Radius Live log is empty

poongarg — Thu, 16 Apr 2020 15:44:07 GMT

In such case, install ISE 2.2 evaluation ova (ISE-2.2.0.470-eval.ova) which have 8 GB RAM reserved. This ova is for evaluating guest access and basic access policy flow. Install latest patch 16 on it.

Re: Cisco ISE Radius Live log is empty

ccna_security — Thu, 16 Apr 2020 16:21:23 GMT

thanks poongard. i wiil install and test it.