topic Re: Missing Attributes after Upgrade 3.2 to 3.3 P4 in Network Access Control

Missing Attributes after Upgrade 3.2 to 3.3 P4

Ticketfarmer — Tue, 11 Feb 2025 14:40:12 GMT

Hello, since the upgrade from 3.2 to 3.3 Patch 4, the "nas_port_id" and others cannot be returned via the ERS API. However, the information is available in the web interface. The configuration has not been changed. Is this maybe a bug?

XML - 3.2

XML 3.3 P4

This XML file does not appear to have any style information associated with it. The document tree is shown below. <sessionParameters> <user_name></user_name> <calling_station_id></calling_station_id> <orig_calling_station_id></orig_calling_station_id> <cpmsession_id></cpmsession_id> <destination_ip_address></destination_ip_address> <device_ip_address></device_ip_address> <acs_server></acs_server> <framed_ip_address></framed_ip_address> <auth_acs_timestamp></auth_acs_timestamp> <audit_session_id></audit_session_id> <posture_status/> <nas_ipv6_address/> <other_attr_string/> <acct_acs_timestamp></acct_acs_timestamp> <acct_session_id></acct_session_id> <acct_status_type></acct_status_type> <acct_input_octets></acct_input_octets> <acct_output_octets></acct_output_octets> <acct_input_packets></acct_input_packets> <acct_output_packets></acct_output_packets> <endpoint_policy></endpoint_policy> </sessionParameters>

Re: Missing Attributes after Upgrade 3.2 to 3.3 P4

thomas — Wed, 19 Feb 2025 22:46:05 GMT

You did not specify any actual REST API URLs but these appear to be the ISE Monitoring REST APIs - not the ISE ERS APIs.

I do not know which API endpoint/URL is supposedly changed or different for you in order to test.

What attributes are supposedly missing besides nas_port_id?

Is your network device sending the nas_port_id in other logs?

My network device is not sending the nas_port_id otherwise, ISE 3.3p4 is working for me:

❱ USERNAME=thomas curl --silent --insecure --location \ --header 'Accept: application/xml'\ --user $ISE_REST_USERNAME:$ISE_REST_PASSWORD \ https://$ISE_PMNT/admin/API/mnt/Session/UserName/$USERNAME \ | xq <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <sessionParameters> <passed http://www.w3.org/2001/XMLSchema-instance:type="xs:boolean" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">true</passed> <failed xsi:type="xs:boolean" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">false</failed> <user_name>thomas</user_name> <nas_ip_address>10.1.10.2</nas_ip_address> <calling_station_id>02:A5:E6:04:B3:FD</calling_station_id> <orig_calling_station_id>02-A5-E6-04-B3-FD</orig_calling_station_id> <cpmsession_id>ac1f0215iPjGeOAV5UR_sBdZ/S09/dYD4WPoll47L1QYIjSC9IQ</cpmsession_id> <destination_ip_address>172.31.2.21</destination_ip_address> <device_ip_address>10.1.10.2</device_ip_address> <identity_group>Workstation</identity_group> <network_device_name>thomas-mr46-2nl6</network_device_name> <acs_server>ise-ppan</acs_server> <authentication_method>dot1x</authentication_method> <authentication_protocol>PEAP (EAP-MSCHAPv2)</authentication_protocol> <framed_ip_address>10.1.10.17</framed_ip_address> <auth_acs_timestamp>2025-02-19T14:32:04.474-08:00</auth_acs_timestamp> <execution_steps>11001,11017,11117,15049,15008,15048,15048,15048,11507,12500,11006,11001,11018,12301,12300,11006,11001,11018,12302,61025,12319,12800,12805,12806,12807,12808,12810,12305,11006,11001,11018,12304,12305,11006,11001,11018,12304,12305,11006,11001,11018,12304,12305,11006,11001,11018,12304,12305,11006,11001,11018,12304,12319,12810,12812,12803,12804,12801,12802,12816,12310,12305,11006,11001,11018,12304,12313,11521,12305,11006,11001,11018,12304,11522,11806,12305,11006,11001,11018,12304,11808,15041,15048,15048,22072,15013,24430,24325,24313,24319,24323,24343,24402,22037,11824,12305,11006,11001,11018,12304,11810,11814,11519,12314,12305,11006,11001,11018,12304,15057,24715,15036,24209,24211,24432,24355,24416,15048,15016,22081,22080,12306,61026,11503,11002</execution_steps> <response>{Class=CACS:ac1f0215iPjGeOAV5UR_sBdZ/S09/dYD4WPoll47L1QYIjSC9IQ:ise-ppan/523956142/51214; Session-Timeout=3600; Termination-Action=RADIUS-Request; cisco-av-pair=cts:security-group-tag=0004-07; MS-MPPE-Send-Key=****; MS-MPPE-Recv-Key=****; LicenseTypes=1; }</response> <posture_status/> <selected_azn_profiles>Permit</selected_azn_profiles> <service_type>Framed</service_type> <message_code>5200</message_code> <auth_acsview_timestamp>2025-02-19T14:32:04.474-08:00</auth_acsview_timestamp> <auth_id>1733869516718246</auth_id> <identity_store>AD</identity_store> <cts_security_group>Employees</cts_security_group> <location>All Locations#Networks#thomas</location> <device_type>All Device Types#Meraki#MR#MR46</device_type> <response_time>96</response_time> <other_attr_string>...</other_attr_string> <acct_id>1733869516714484</acct_id> <acct_acs_timestamp>2025-02-19T12:32:03.445-08:00</acct_acs_timestamp> <acct_acsview_timestamp>2025-02-19T12:32:03.445-08:00</acct_acsview_timestamp> <acct_session_id>65ED0CA4BB7AEC98</acct_session_id> <acct_status_type>Start</acct_status_type> <acct_input_octets>0</acct_input_octets> <acct_output_octets>0</acct_output_octets> <acct_input_packets>0</acct_input_packets> <acct_output_packets>0</acct_output_packets> <acct_authentic>RADIUS</acct_authentic> <acct_delay_time>0</acct_delay_time> <event_timestamp>1739997123</event_timestamp> <started xsi:type="xs:boolean" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">true</started> <stopped xsi:type="xs:boolean" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">false</stopped> <endpoint_policy>OS_X_Catalina-Workstation</endpoint_policy> </sessionParameters>

Re: Missing Attributes after Upgrade 3.2 to 3.3 P4

Ticketfarmer — Thu, 20 Feb 2025 05:52:41 GMT

Hello Thomas,

I use the following URL: https://ise.domain/admin/API/mnt/Session/MACAddress/12:FA:3B:82:8B:73

In the GUI I can see the nas_port_id.

These attributes are missing in 3.3P4:

acct_acsview_timestamp acct_authentic acct_delay_time acct_id auth_acsview_timestamp auth_id authentication_method authentication_protocol device_type event_timestamp execution_steps failed identity_group identity_store location message_code nas_ip_address nas_port_id network_device_name passed response response_time selected_azn_profiles service_type started stopped