topic Re: ISE Reauthentication - taking long time in Network Access Control

ISE Reauthentication - taking long time

Abdulaziz Loonat — Thu, 26 Jan 2023 12:52:12 GMT

Using ISE 2.7 Patch 8

since we upgraded to the above patch I have noticed reauthentication from the Meraki Wireless AP taking longer to reauthenticate

Looking on ISE, I have noticed the following at the time the issue occurs

Received RADIUS Access-Request (step latency=22240 ms Step latency=22240 ms)

Trying to work out if the issue is with the access point or ISE

I am new to ISE as well, so can somone confirm what could be the reason for this long delay.

I am wondering is it packet loss from access point to the RADIUS server

Re: ISE Reauthentication - taking long time

ahollifield — Thu, 26 Jan 2023 14:14:48 GMT

What is the network path between the MR and ISE? What is the ID store?

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

Re: ISE Reauthentication - taking long time

Abdulaziz Loonat — Thu, 26 Jan 2023 15:07:39 GMT

The hops between the MRE and ISE is 8

This is effecting multiple offices, the only common factor is the ISE device is a data centre. Offices are connected via SD WAN to the data centre

As I am new to ISE, I assume the ID store is Active Directory

Re: ISE Reauthentication - taking long time

ahollifield — Thu, 26 Jan 2023 15:36:52 GMT

How do the resources on ISE look? What is your deployment type? Are you within the scale limits? https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Re: ISE Reauthentication - taking long time

Arne Bier — Thu, 26 Jan 2023 20:52:53 GMT

If ISE PSNs are hosted on VMs, and if you have access to the VM Management, then perhaps look at a trend in CPU performance or disk IO activity. If the patch did some weird stuff then you're likely to spot it in historical trending. ISE also records its own performance but I prefer to see it from the hypervisor's perspective.

You could also see whether you have Session Resume enabled on your EAP-XXX protocols in ISE. That should eliminate some of the TLS overhead. And stateless session resume is also a nice performance tweak.

Re: ISE Reauthentication - taking long time

Abdulaziz Loonat — Thu, 26 Jan 2023 21:37:11 GMT

We run ISE on a appliance box, Model is 3615, which meets the setup we have in terms of endpoints.

I ask this, we didnt have this issue before we applied patch 8

Re: ISE Reauthentication - taking long time

Marcelo Morais — Sat, 28 Jan 2023 06:07:18 GMT

Hi @Abdulaziz Loonat ,

since you " ... didn't have this issue before we applied Patch 8 ... ", could please share the result of the following command:

ise/admin# show version history

Regards

Re: ISE Reauthentication - taking long time

hslai — Sun, 05 Feb 2023 02:03:15 GMT

@Abdulaziz Loonat : Take a look at README_Hotpatch_CSCwc74531_and_CSCwd45843.txt and consider apply it.