topic Re: 12929 NAS sends RADIUS accounting update messages too frequently in Network Access Control

12929 NAS sends RADIUS accounting update messages too frequently

alliasneo1 — Wed, 18 Dec 2024 08:48:42 GMT

Hi, I have a new problem today. I am seeing this from all the switches that are running ISE. How can I fix this?

Re: 12929 NAS sends RADIUS accounting update messages too frequently

Cristian Matei — Wed, 18 Dec 2024 09:34:43 GMT

Hi,

Disable RADIUS interim accounting or set it to a higher value, as well as configure ISE suppression under "Administration -> System -> Settings -> Protocols -> RADIUS".

Check this document as well, for further reference: https://community.cisco.com/t5/security-knowledge-base/ise-data-limiting-best-practices/ta-p/4310073

Best,

Cristian.

Re: 12929 NAS sends RADIUS accounting update messages too frequently

alliasneo1 — Wed, 18 Dec 2024 10:34:23 GMT

I have the defaults set in ISE:

When you say - Disable RADIUS interim accounting or set it to a higher value - What do you mean here? on the switch?

Re: 12929 NAS sends RADIUS accounting update messages too frequently

Ambuj M — Wed, 18 Dec 2024 11:33:23 GMT

You can set something like “aaa accounting update newinfo periodic 2880” on the switch, this is for 48 hours but you can set time accordingly .

Re: 12929 NAS sends RADIUS accounting update messages too frequently

Cristian Matei — Wed, 18 Dec 2024 11:46:58 GMT

Hi,

Yes, on the switch.

Best,

Cristian.

Re: 12929 NAS sends RADIUS accounting update messages too frequently

MHM Cisco World — Wed, 18 Dec 2024 11:47:09 GMT

"aaa accounting update periodic 15" <<- add this in SW

MHM

Re: 12929 NAS sends RADIUS accounting update messages too frequently

alliasneo1 — Wed, 18 Dec 2024 15:16:36 GMT

Thanks I will try this

Re: 12929 NAS sends RADIUS accounting update messages too frequently

MHM Cisco World — Wed, 18 Dec 2024 15:49:08 GMT

Believe me What i suggest is only workaround.

We need to know why SW start authc endpoint many times.

Do you have any up/down interface log ?

MHM