topic Re: About "Source Timestamp" and "Received Timestamp&qu in Network Access Control

About "Source Timestamp" and "Received Timestamp" in ISE Live log

JustTakeTheFirstStep — Wed, 10 Jan 2024 04:23:55 GMT

I want to know what equipment Source and Recive refer to in the livelog.

The device is using 1X authentication and ISE is associated with an AD server.

Re: About "Source Timestamp" and "Received Timestamp&qu

Arne Bier — Wed, 10 Jan 2024 05:42:28 GMT

Great question. I have never thought about what this means.

The RADIUS Access-Request (UDP packets) does not contain any time stamp information. Therefore, I assume these timestamps must refer to some ISE components that are involved in the processing of the RADIUS Access-Request.

I am guessing "Source" refers to the time the RADIUS UDP packet was received from the network stack.

And "Received" refers to some other stage thereafter. But it's a very small time difference. In my lab, the timestamps are identical.

I am hoping someone has the definitive answer.

Re: About "Source Timestamp" and "Received Timestamp&qu

MHM Cisco World — Wed, 10 Jan 2024 05:55:21 GMT

Re: About "Source Timestamp" and "Received Timestamp

Arne Bier — Wed, 10 Jan 2024 07:47:19 GMT

Nice image. Where did this come from?

Do you know what is meant by “The Radius”?

I could not find any timestamp in the RADIUS packet. Maybe I was in a hurry and missed it.

Re: About "Source Timestamp" and "Received Timestamp

MHM Cisco World — Wed, 10 Jan 2024 10:15:38 GMT

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKSEC-3229.pdf

I think this stamp is appear only when we use distribute in which MnT and PSN is separate

hope I am right

MHM

Re: About "Source Timestamp" and "Received Timestamp&qu

Arne Bier — Wed, 10 Jan 2024 23:12:47 GMT

@JustTakeTheFirstStep - what does your setup look like?

I can't find any examples in any of my ISE 3.1 or ISE 3.2 customers where there is any difference in this timestamp. And all my customers have distributed deployments.

I even checked with one customer who has an SNS server acting as PSN in a remote location over slow comms links - there is no difference there in the LiveLogs Auth Details timestamps.

The plot thickens ... 🙂

Re: About "Source Timestamp" and "Received Timestamp&qu

hslai — Sat, 13 Jan 2024 02:53:23 GMT

@MHM Cisco World Standalone ISE also has them.

@JustTakeTheFirstStep I think the source is the ISE PSN performing the authentication and the source timestamp is when this ISE PSN sends out the event to the ISE MNT; the received timestamp is when the ISE MNT records it receives the event. If the clocks of all ISE nodes are properly synchronized and we should see little difference if low latency between ISE PSN and MNT.

Re: About "Source Timestamp" and "Received Timestamp&qu

MHM Cisco World — Sat, 13 Jan 2024 17:03:50 GMT

There is so little offset that why I think about distrubte mode not standalone.

MHM