topic Re: Endpoint status in visibility remains connected after disconnect in Network Access Control

Endpoint status in visibility remains connected after disconnect

Cloud2 — Wed, 10 Nov 2021 07:16:53 GMT

Endpoint status in visibility remains "connected" although its already disconnected on switch side...

what could cause for such behavior?

Re: Endpoint status in visibility remains connected after disconnect

Arne Bier — Wed, 24 Nov 2021 06:54:13 GMT

that would be due to a lack of AAA RADIUS accounting - you need to tell ISE that the session has ended by means of RADIUS Accounting (Stop).

In IOS/IOS-XE, add something along the lines of

aaa accounting identity default start-stop group radius-ise-group
aaa accounting update newinfo periodic 2880

The periodic 2880 means, send a RADIUS Accounting Interim Update no later than every 48 hours - it's like a keepalive to let ISE know the session is still there. If the IP address of the client were to change, then the switch will send an update anyway.

Re: Endpoint status in visibility remains connected after disconnect

Cloud2 — Wed, 24 Nov 2021 13:55:11 GMT

Hi @Arne Bier ,

Thank you for assistance, I've added the accounting lines into switch config