ISE reporting issues

Florian Brenner — Mon, 11 Mar 2019 05:39:09 GMT

Hi,

Is there a possibility to show the failed authentications in a summarized way?

Here a short explanation of the background:

During the open mode I need a daily list of failed MAB authentications. I know I can do this with the authentications report. But this list is full of duplicates because the entries are based on timestamps (I use ‘authentication timer restart’ to define an interval, where an unauthorized port has to do a new authentication, e.g. 4 hours) and then you have lots of duplicate entries of the same mac address in this list.
Another problem is that sometimes a client, which is normally authorized successful with dot1x do a mac authentication because the tx-period to MAB fallback is to short (that`s no problem because the priority is set to dot1x). But this mac address is also shown in the list of failed mab authentications although it has a successful dot1x authentication.

In short words:

I need a list of failed mac authentications without duplicates and without mac addresses, that has a successful dot1x authentication.

Do you have any ideas to do that?

Thanks

hello Florian , have you

Venkatesh Attuluri — Tue, 21 Apr 2015 10:57:51 GMT

hello Florian , have you tried using filters in reports

topic hello Florian , have you in Network Access Control

ISE reporting issues

hello Florian , have you