topic High Authentication Latency alarm in ISE in Network Access Control

High Authentication Latency alarm in ISE

Arthur Martez — Fri, 26 Aug 2022 18:01:04 GMT

Hi.

I recently detected the alarm "High Authentication Latency" in ISE. When I check the node latency in System Summary Dashboard it has between 220 ms - 260 ms of latency.

Yesterday the latency went so high (2137 ms) I applied a reload and all went ok after that.

In logs I can the evaluating policy group is taking so long:

Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
15049 Evaluating Policy Group ( Step latency=3961 ms)
15008 Evaluating Service Selection Policy
15048 Queried PIP - DEVICE.Location
15048 Queried PIP - Radius.Called-Station-ID

In all cases I can see internal steps of ISE (AD is not taking place with the latency).

Any idea of what could be causing the latency problem?

ISE Version 2.7.0.356 patch 3.

Thank you.

Re: High Authentication Latency alarm in ISE

Marcelo Morais — Sat, 27 Aug 2022 03:55:53 GMT

Hi @Arthur Martez ,

1st please take a look at Building ISE RADIUS Policy Sets (special attention to ISE Policy Optimization and Authorization Policy Optimization).

2nd please take a look at ISE 2.7 Release Notes (the new Patches from 4 to 7 solved not only some latency issues, but also some memory leak issues)

3rd please take a look at Performance and Scalability Guide for ISE (special attention to Table 4. Specifications for Different Hardware Platforms and Cisco ISE Deployment Scale Limits).

Hope this helps !!!

Re: High Authentication Latency alarm in ISE

ahollifield — Mon, 29 Aug 2022 12:22:16 GMT

Also Patch 3 is pretty old at this point. I would recommend applying Patch 7. Also consider an upgrade to 3.1.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

Re: High Authentication Latency alarm in ISE

Arthur Martez — Thu, 01 Sep 2022 15:03:37 GMT

@Marcelo Morais , @ahollifield

Thank you, I will apply ISE patch 7 and see if it solves the problem.

Re: High Authentication Latency alarm in ISE

justclash4 — Tue, 20 Aug 2024 18:02:23 GMT

@Arthur Martez

Did it solve your problem?

Re: High Authentication Latency alarm in ISE

Marcelo Morais — Tue, 20 Aug 2024 20:27:19 GMT

Hi @justclash4

please take a look at ISE - Slow Replication Error, search for Field Notice ... you are able to check the Releases impacted with System Performance.

Hope this helps !!!