Cisco ISE Radius Live log is empty

Tiroyaone72926925 — Sun, 21 May 2023 14:21:02 GMT

I have built a 0home virtual lab and it comprises the following devices: CISCO ISE 3.2, Windows Server with CA,AD,DNS roles, and an access switch serving as NTP and NAD.

ISE and AD are integrated.

ISSUE:

when i test RADIUS authentication on the switch using #test aaa group <ISEGROUP> <username> <password1> new-code,

i get User successfully authenticated message which is OK,

However, i can't see the live sessions/logs ISE, It is empty.

in an attempt to resolve the issue: I have disabled "ISE Messaging Service", generated CSR for ise messaging, and re-enabled ISE messaging, but it couldn't work.

Below are my radius configs on the switch:

aaa new-model
aaa group server radius ISEGROUP
server name ISESERVER
ip radius source-interface Vlan1

aaa authentication dot1x default group ISEGROUP
aaa authorization network default group ISEGROUP
aaa authorization auth-proxy default group ISEGROUP
aaa accounting update periodic 5
aaa accounting dot1x default start-stop group ISEGROUP
aaa accounting system default start-stop group ISEGROUP

aaa server radius dynamic-author
client 192.168.48.2 server-key PasswordISE
aaa session-id common

ip name-server 192.168.48.11
ip device tracking

!
dot1x system-auth-control
!
interface Vlan1
ip address 192.168.48.254 255.255.255.0
!
ip default-gateway 192.168.48.4
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server attribute 31 send nas-port-detail
radius-server dead-criteria time 5 tries 3
radius-server cache expiry 1
radius-server vsa send accounting
radius-server vsa send authentication
!
radius server ISESERVER
address ipv4 192.168.48.2 auth-port 1812 acct-port 1813
key PasswordISE

Re: Cisco ISE Radius Live log is empty

SHABEEB KUNHIPOCKER — Sun, 21 May 2023 19:00:26 GMT

Have you checked the time/timezone on the ISE CLI?.

Re: Cisco ISE Radius Live log is empty

Arne Bier — Sun, 21 May 2023 20:40:49 GMT

Are you perhaps suppressing the logging of "username" (sorry ... I had to ask 🙂

Administration > System > Logging > Collection Filters

If not - Is this a standalone ISE node? If you're seeing Queue Link Errors in the Alarms Dashboard, then you should generate a CSR to regenerate the internal ISE Root CA cert. That fixes that. It might be related to the Live Logs.

Have you applied any patch to ISE 3.2 ? Patch 2 is out now - worth trying that.

Re: Cisco ISE Radius Live log is empty

Tiroyaone72926925 — Mon, 22 May 2023 13:10:50 GMT

I am rebuilding the server, I will try your suggestion and get back to you

topic Cisco ISE Radius Live log is empty in Network Access Control

Cisco ISE Radius Live log is empty

Re: Cisco ISE Radius Live log is empty

Re: Cisco ISE Radius Live log is empty

Re: Cisco ISE Radius Live log is empty