topic Re: ISE - "Misconfigured Network Device Detected" Alarm in Network Access Control

ISE - "Misconfigured Network Device Detected" Alarm

OrkhanRustamli — Mon, 15 Jun 2020 08:54:42 GMT

Hi all!

I am getting a lot of "Misconfigured Network Device Detected" alarms from one of my newly added device in ISE. I know that this usually means either misconfigured secret key and deleting and adding device and key on device side is solving the issue but the problem is after each of this alaram there is next "fixed" alarm coming like in below attached screenshot:

What can be the cause of this issue? Is it bug and do I need to disable the alarm?

Re: ISE - "Misconfigured Network Device Detected" Alarm

El_Woutro — Mon, 15 Jun 2020 11:27:25 GMT

Maybe the configured IP is already in use for another device that is working correctly?

Re: ISE - "Misconfigured Network Device Detected" Alarm

Mike.Cifelli — Mon, 15 Jun 2020 13:49:44 GMT

This can occur if the NAD sends multiple accounting events in a given time. You can configure ISE to suppress and ignore repeated updates within a configured window. See Administration->System->Settings->Protocols->RADIUS. Also, for a deeper understanding take a peek at the 'Radius Settings' section found here: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/Workflow/b_threat_containment_2_4.html

Re: ISE - "Misconfigured Network Device Detected" Alarm

poongarg — Tue, 16 Jun 2020 01:52:17 GMT

How frequently the alarms are coming and what network device it is (WLC/switch).

Re: ISE - "Misconfigured Network Device Detected" Alarm

OrkhanRustamli — Fri, 19 Jun 2020 09:18:28 GMT

After each 1 or 2 hours! Device is WLC

Re: ISE - "Misconfigured Network Device Detected" Alarm

OrkhanRustamli — Fri, 19 Jun 2020 09:18:58 GMT

Nope, not a option.

Re: ISE - "Misconfigured Network Device Detected" Alarm

Greg Gibbs — Mon, 22 Jun 2020 00:14:54 GMT

If you have not done so, you might check your WLC configuration against the Top Six Important Cisco WLC settings for ISE integration