topic Re: ISE Radius Live Log Issue in Network Access Control

ISE Radius Live Log Issue

FY13 — Fri, 04 Jun 2021 08:33:12 GMT

We have an ISE deployment running 2.7 patch 3, and there seems to be some sort of mismatch (I'm guessing) between the MnT nodes, but I'm not 100% sure on that. On some occasions, the Radius Live Log shows all the info you'd expect, like so:

But then, suddenly, it will show something like this:

Only "Authorize Only" methods will be shown.

And it stays like this for 10 minutes or so before changing back to showing all expected info again.

Any ideas how to explain this?

Thanks

Re: ISE Radius Live Log Issue

thomas — Sat, 05 Jun 2021 22:37:59 GMT

The only difference here appears to be the SessionInfo status icons instead of the Pass/Fail/Session icons.

Auth Passed (Green check): ISE returned RADIUS ACCESS-ACCEPT as result of the policy for a successful WebAuth, CoA, or PAC provisioning.
Auth Failed (Red X): Returned a RADIUS ACCESS-REJECT as result of policy rule, authentication failure, suppression settings, unknown NAD, etc.
Session (Blue i): ISE received RADIUS Accounting Start after the Auth Passed. A log line will also be updated upon receiving an interim accounting update.

ISE refreshes your LiveLogs every 10 seconds according to your screen and after a while - "some occasions" as you say - you have a see Pass/Fails rather than only Session updates.

This is probably due to re-authentication intervals and RADIUS interim updates in your endpoint sessions.

Click on the session details icon to see what is happening or filter on a specific endpoint to see it's series of authentication events.

Re: ISE Radius Live Log Issue

FY13 — Mon, 07 Jun 2021 07:45:35 GMT

Thanks for replying Thomas. So I tried what you said, filtering on one endpoint, but the result is still the same. It first shows just the Session Info, then 10 minutes later, the Auth Passed records suddenly appear as well.

Re: ISE Radius Live Log Issue

hslai — Tue, 08 Jun 2021 13:33:55 GMT

This points potentially some issue with the ISE M&T db. Please check the performance data of the MnT node(s) and engage Cisco TAC as needed.