topic RADIUS Live sessions not getting cleared even with accounting stop in Network Access Control

RADIUS Live sessions not getting cleared even with accounting stop

SMD28316 — Mon, 24 Jan 2022 18:34:24 GMT

On ISE 2.6 I see old RADIUS live sessions with terminated state, some of them are from Dec of 2021, shouldn't they be cleared? I thought they get cleared every 120 hours, not sure if the issue is from ISE or from accounting configuration on the network devices, on ISE I see accounting start followed by accounting stop, so I don't understand this inconsistancy.

I appreciate any hints or guides on how do I troubleshoot this.

Re: RADIUS Live sessions not getting cleared even with accounting stop

Rob Ingram — Mon, 24 Jan 2022 18:52:14 GMT

@SMD28316 What aaa accounting configuration have you configured on your switches? When the users/device disconnects an accounting stop packet should be sent and the session terminated in ISE.

Can you double check your switch configuration.

You can specify the switch to send accounting information to ISE at endpoint session start and stop events:

SWI(config)#aaa accounting identity default start-stop group ISE

And configure the switch to send periodic accounting updates for active sessions once every two days:

SWI(config)#aaa accounting update newinfo periodic 2880

Refer to the ISE wired prescriptive guide:

https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

Re: RADIUS Live sessions not getting cleared even with accounting stop

hslai — Sun, 30 Jan 2022 21:39:00 GMT

See CSCvq63061