topic Re: No Authentications in the last 15 minutes in Network Access Control

No Authentications in the last 15 minutes

dgaikwad — Thu, 24 Mar 2022 06:55:52 GMT

Hi Experts,

I am seeing this error being reported for every 15 minutes.
And clicking on details button is greyed out.
Currently running ISE 2.7 with patch 3.

Is there any ways to suppress this message?
It does seem to be reported for 2.7 as a bug, and patch fix is not listed: Cisco Bug: CSCvw21033 - ENH: ISE: "ISE Authentication Inactivity" alarm - no details available

Any suggestions.

Re: No Authentications in the last 15 minutes

Octavian Szolga — Thu, 24 Mar 2022 09:25:12 GMT

Hi,

The alarm is pretty obvious. Because ISE is basically a RAIDUS server used for wired/wifi (MAB/802.1x) or VPN (pure RADIUS) environments, it raises an alarm when it's not used, because it's considered unusual. A network that uses ISE for all 3 network connectivity options (wired/wifi/VPN) should almost always send to ISE some auth requests.

If your network is not that noisy, you can disable the alarm itself from Administration > System Settings > Alarm Settings >

ISE Authentication Inactivity.

BR,

Octavian

Re: No Authentications in the last 15 minutes

thomas — Thu, 24 Mar 2022 18:35:29 GMT

If you are testing ISE in a lab, this can be quite normal because you may only have a few devices connecting infrequently.

However, depending on your configured session timeouts, for almost all production networks with more than few hundred endpoints, it should be extremely alarming (literally) not to see one single authentication for 15 minutes. This would indicate an anomalous lack of endpoint authentication requests coming into ISE which means something is likely to be down or misconfigured.

You provided no details about your actual request traffic or patterns to confirm or deny which is happening.

If you are getting this alarm and do have one or more requests every 15 minutes, call TAC and file a bug.

Re: No Authentications in the last 15 minutes

dgaikwad — Fri, 26 Aug 2022 08:10:16 GMT

All the wireless traffic is being sent to just one SSID and this SSID has the two PSNs configured for it.
Seems that only one PSN receiving the RADIUS traffic and this alarm being generated.

Re: No Authentications in the last 15 minutes

Damien Miller — Sat, 27 Aug 2022 04:25:56 GMT

While the alarm doesn't have anything to indicate it, this is per node. There are a couple enhancement requests to improve it, but alas it's still a general alarm for now. Given that all of your authentication is being directed at one node, the second one is likely throwing this alarm accurately.

I would suggest splitting your load 50/50, no reason to make a single node process all requests.

There are scenarios where the alarm occurs because of log ingestion issues, but those are not very common.