topic Re: ISE 3.2 Repeat Count Details in Network Access Control

ISE 3.2 Repeat Count Details

marco.merlo — Tue, 16 Apr 2024 16:01:52 GMT

Hi,

on ISE 2.4 in the live logs pages the report that one got clicking on the repeat counter was very useful because the endpoints were sorted by repeat counters. So it was very easy to find the endpoints with high repeated counters.

With ISE 3.2 the report is still present but the the sort key is another one so the endpoint with multiple repeated counters are indeed not shown.

Has anyone else noticed the same issue?

Regards

Re: ISE 3.2 Repeat Count Details

Arne Bier — Wed, 17 Apr 2024 22:57:04 GMT

can you please put some screenshots in the discussion? I tried to follow your comments, but I can't find what you're referring to exactly.

Re: ISE 3.2 Repeat Count Details

marco.merlo — Thu, 18 Apr 2024 10:48:18 GMT

Hi Arne,

please refer to the attached video. On ISE 2.4 after clicking on "Repeat Counter" the resulting report used to show "top talkers" endpoints at the top of the list so it was very easy to find the endpoints that performed an anomalous number of authentications.

Regards

Re: ISE 3.2 Repeat Count Details

Arne Bier — Thu, 18 Apr 2024 23:18:52 GMT

Ok. I checked on my ISE 3.2p5 setup and It's sorting the top talkers in descending order (highest to lowest) repeat count. There is no sort by column option. Looks alright. I built that system clean from ISE 3.2 (no upgrades).

In your video it shows a large repeat counter - I have to assume that you have Suppression enabled under Administration > System > Protocols > RADIUS ?

Because on other systems where this is disabled, the Repeat Details page looks like yours (0 Repeats) - I guess that is obvious in cases where Suppression is disabled. But that is all I can think of. Perhaps this is a TAC case? They might tell you to run some of those CLI commands on the PAN to sort out the MNT/Session Database.

Re: ISE 3.2 Repeat Count Details

Marvin Rhoads — Fri, 19 Apr 2024 15:14:45 GMT

As a point of comparison, I just checked a 3.1 p7 deployment and it also sorts repeats from highest to lowest.

Re: ISE 3.2 Repeat Count Details

MHM Cisco World — Mon, 22 Apr 2024 06:31:47 GMT

last week I study about ISE (advanced) and see these two slides check it

Re: ISE 3.2 Repeat Count Details

marco.merlo — Mon, 22 Apr 2024 06:58:41 GMT

Thank you very much.

I have patch 4 installed so far because we are waiting for patch 6 in order to solve

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi42628 (this buf fill costed me a 10 months long case ....)

@MHM Cisco World

the weird thing here is that repeat counters are present in live logs

the issue is about the way they are (not) sorted in the report.

Another think I note is that , with the very same endpoint set, repeat counters are far less in 3.2 then I was used to see in 2.4.

Regards

Re: ISE 3.2 Repeat Count Details

MHM Cisco World — Mon, 22 Apr 2024 07:05:15 GMT

Did you check config I share in both patch?

Compare the config

MHM

Re: ISE 3.2 Repeat Count Details

marco.merlo — Mon, 22 Apr 2024 07:25:06 GMT

Yes , I think they are default values .

I'll wait for patch 6 and see.

Thanks