topic Re: ISE 3 Seeing non RADIUS Active Endpoints in Network Access Control

ISE 3 Seeing non RADIUS Active Endpoints

mlcsu.ciscosmart1 — Tue, 13 Jul 2021 17:01:30 GMT

We have a strange scenario on our ISE 3 deployment. We have a single WLAN for clients authenticating to ISE with EAP-TLS via a 5520 WLC on v8.2. The WLAN has the ISE deployment as the Authentication and Accounting servers. We have 10 other WLANS that do not ustilise ISE for AAA, however the authentications for these appear in 'Active Endpoints'. I can't figure out how these are appearing in ISE as none of them have accounting pointing to that deployment. Has anyone seen this? Is this normal behaviour and if so - how is ISE getting this data?

Re: ISE 3 Seeing non RADIUS Active Endpoints

Marcelo Morais — Tue, 13 Jul 2021 22:25:27 GMT

Hi @mlcsu.ciscosmart1 ,

please use the: Operations > Troubleshoot > Diagnostic Tools > General Tools > TCP Dump and

filter with: ip host <Host IP Addr>

to check where you are receiving the AuthC request from.

Hope this helps !!!

Re: ISE 3 Seeing non RADIUS Active Endpoints

Massimo Baschieri — Wed, 14 Jul 2021 04:10:37 GMT

Be sure to completely disable authentication and accounting on the wlc for the non 802.1x ssids into security/aaa servers tab