topic Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes in Network Access Control

Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Ditter — Mon, 11 Mar 2019 08:47:18 GMT

Hi to All,

I think that a lot of discussion has been around this "No Authentications in the last 15 minutes" and as i noticed int he bug reporting tool this would be fixed in ISE 2.4(357) , however i have this version and the message is still active. I also changed the Radius settings under Administration --> Settings --> Protocols --> radius from 15 minutes to one hour but i do not think that it is the correct setting.

So the question still remains: Is thre a way to reduce these inactivity authentication messages?

Thank you,

Ditter

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Ditter — Wed, 01 Aug 2018 11:43:47 GMT

Just bouncing the thread!

Any noew of how to suppress this kind of message. I am running ISE 2.4(357)

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

vthaluru — Wed, 01 Aug 2018 11:53:59 GMT

Hi Ditter,

Just check have you selected the log collector for passed and failed authentication on logging categories.

If you are not selected ,then please select it and it will stop.

Thanks

VenkataKrishna

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Ditter — Wed, 01 Aug 2018 13:09:01 GMT

Hi VThaluru,

the logging was as you can see in the attached image. I now selected log collector for both passed and failed notifications. I will let you know if something changes.

Thanks a lot.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Ditter — Thu, 02 Aug 2018 09:05:03 GMT

Hi, unfortunately nothing changed after selecting logcollector for both passed and failed logins.

The messages keep coming every 15 minutes:

Alarm Name :
ISE Authentication Inactivity

Details :
No Authentications in the last 15 minutes

Description :
The ISE Policy Service nodes are not receiving Authentication requests from the Network Devices

Severity :
Warning

One thing i noticed is that the Failed and Passed attempts have as severity INFO, but in our case the severity is Warning, thus we are talking about a different parent category.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Ditter — Fri, 03 Aug 2018 09:16:46 GMT

So are we still hitting the bug CSCuz52877 even in ISE 2.4 (357) ?

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

hslai — Sun, 05 Aug 2018 02:50:41 GMT

Go to the Alarm Settings page, select this alarm, edit its status to disable, and save.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Steve Dussault — Fri, 14 Sep 2018 12:30:41 GMT

I am also seeing this issue in release 2.4(0.357).

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

hpenley — Thu, 08 Aug 2019 13:10:59 GMT

I'm still getting the warning notification.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Jetpack — Wed, 28 Oct 2020 17:50:11 GMT

Worked great for this.
I wish I could do this for the certificate expired. Have one that kicks out that warning for a certificate that doesn't exist. Can't figure out where that ghost certificate is/was because it isn't listed in the GUI.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

mumustha — Thu, 04 Mar 2021 09:01:16 GMT

Hi Jetpack,

You could reach out to Cisco TAC to clear the expired certificate from the ISE DB if not present in the ISE GUI.
Disabling the ISE certificate expiry alarm will not be the best way forward as usable certificates may also fall in this category.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Thomas Hontz Jr — Mon, 29 Mar 2021 11:39:55 GMT

Also you probably won't be able to upgrade with the ghost certificate. I ran into this problem a while back. TAC will be able to clear it for you.

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

fabianwickman — Thu, 01 Apr 2021 12:13:43 GMT

Hi, We are seeing this alarm in 2.7 patch 3.

Should you really disable the alarm? Is it just cosmetic? What if there is an issue that needs to be fixed in the network?

Re: Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

Damien Miller — Thu, 01 Apr 2021 15:24:51 GMT

Under normal deployment functions it can certainly indicate a major problem if it suddenly starts. The reason this alarm is generated is because there is no radius authentication hitting a node, or the logging from that node has failed. This could indicate a network reachability issue, a load balancer issue, or something internal to ISE.

False positives are common if all your authentication uses the same node as primary. The secondary may report this alarm since nothing is configured to use it it unless the primary is down. If the load is balanced across the primary and secondary (or more nodes), then assuming radius hits the nodes at least once every 15 minutes, the alarm will not be triggered.

Disabling it is common since many use a primary/secondary, I suggest balancing the load either way.