topic Re: Displaying Incorrect IP Address in "Authentication Detail Rep in Network Access Control

Displaying Incorrect IP Address in "Authentication Detail Report"

rezaalikhani — Fri, 29 Dec 2023 16:04:08 GMT

Hi all;

Look at the following screenshot:

In the above scenario, the "Win-PC-02" is connected to an interface that belongs to VLAN 20. After authentication, proper authorization policy applied to that interface which changes the VLAN of it to 10. So, although the client has successfully assigned IP address in VLAN 20, after applying proper authorization policy it changed its address to something in VLAN 10.

Now I decide to see the detail authentication report for the following operation:

As you can see above, under the "IP Address" column, we see "192.168.10.15", but in the report:

I use ISE 3.2 Patch 4.

Any ideas?

Thanks

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

Ruben Cocheno — Fri, 29 Dec 2023 16:23:37 GMT

@rezaalikhani

Is the timestamp correct on the report? it shows 20minutes past time of the Authz

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

rezaalikhani — Sun, 31 Dec 2023 06:37:55 GMT

Thanks for your reply;

Yes it is correct because the last picture is not related to the first picture. It is taken from a similar authentication and authorization flow, not just from the first picture in the post...

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

MHM Cisco World — Sun, 31 Dec 2023 10:28:08 GMT

you use DHCP profiling ?
MHM

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

rezaalikhani — Sun, 31 Dec 2023 13:22:45 GMT

Yes

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

Arne Bier — Mon, 01 Jan 2024 22:34:01 GMT

ISE learns about the endpoint's IPv4 address via the IOS Device Tracking feature (should always be enabled) - even if you are not using DHCP, device-tracking will issue a regular gratuitous ARP to get the IPv4 address of the endpoint. In the case of IPv6, it can glean addresses from the ND messages.

show ip device-tracking database int x/y/z

However, I agree with you @rezaalikhani , that when you click on the details of one of the rows in Live Logs, that the IP addressing data should correspond. I think that ISE does some caching behind the scenes and I know that the "blue dot" icon LiveLog entries (Session records) typically don't include updated RADIUS attribute data - they take their data from the original/first Authentication.

Have you tried the same test with Successful Repeated Auths suppression disabled? Worth a try - but like I said, the blue dot indicates an Accounting record was received, and then ISE cheats a little (or, it chooses to be lazy) with the data it chooses to present.

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

MHM Cisco World — Mon, 01 Jan 2024 23:13:46 GMT

what is attribute you use in DHCP profile ?

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

hslai — Tue, 02 Jan 2024 05:21:36 GMT

@rezaalikhani

From what you described above, it looks expected. Before the PC authenticates, it receives the IP address from VLAN 20 so it sends this as part of the authentication request. After it authorizes, it moves to VLAN 10 and receives the new IP assignment. At this point, the switch sends the accounting request(s) to update the client IP address but not another authentication request so the authentication report will show the IP from VLAN 10 instead of VLAN 20. If you check the RADIUS accounting reports, you should be able to see one to update the client IP.

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

MHM Cisco World — Tue, 02 Jan 2024 05:33:06 GMT

Can we see the switchport config

@hslai mention perfect point but I need to see port config to more sure.

MHM

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

MHM Cisco World — Wed, 03 Jan 2024 06:42:31 GMT

sorry @rezaalikhani
can you share the SW port config
MHM

Re: Displaying Incorrect IP Address in "Authentication Detail Rep

rezaalikhani — Wed, 03 Jan 2024 06:44:08 GMT

C3650#show run interface fastEthernet 0/2
Building configuration...

Current configuration : 834 bytes
!
interface FastEthernet0/2
switchport access vlan 20
switchport mode access
ip device tracking maximum 2
authentication control-direction in
authentication event fail action next-method
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-host
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 30
authentication timer reauthenticate server
dot1x pae authenticator
dot1x timeout quiet-period 30
dot1x timeout tx-period 10
dot1x timeout ratelimit-period 300
dot1x timeout held-period 30
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
end

C3650#