topic ISE 3.3 patch 4 Golden Release doesn't show failure authentication log in Network Access Control

ISE 3.3 patch 4 Golden Release doesn't show failure authentication log

ThorMarcos — Thu, 20 Feb 2025 17:42:01 GMT

Hi Guys, we were running ISE 3.1 and upgraded to a test environment to version 3.3 patch 4 and we were testing some scenarios and I realized that when going to live logs, only session logs are shown, failed authentication logs are not showing and also succeed logs are not shown, when clicking to view in detail, there is no possibility to do it. It doesn't show any detail. We had to redeploy it to go back to 3.1, does anyone had face the same issue?

Re: ISE 3.3 patch 4 Golden Release doesn't show failure authentication

Arne Bier — Sun, 23 Feb 2025 20:36:18 GMT

Not seen this in 3.3p4 - I have been running it since patch 4 was released. It sounds like the upgrade/patch introduced some kind of a Collection Filter like behaviour. Do you see Passed and Failed Auths in the Reports for RADIUS auths?

Re: ISE 3.3 patch 4 Golden Release doesn't show failure authentication

Greg Gibbs — Sun, 23 Feb 2025 20:52:33 GMT

Did you try regenerating the Root CA chain, ISE Messaging Service certificate, and reset the MnT Database as per the Upgrade Journey document?
https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/Cisco_ISE_3-3_Upgrade_Journey.html#id_125864

Re: ISE 3.3 patch 4 Golden Release doesn't show failure authentication

Scott Fella — Sun, 23 Feb 2025 21:08:15 GMT

I run into this because I restore a backup from our prod to multiple versions of ISE test nodes. I always have to either toggle Use "ISE Messaging Service" for UDP Syslogs delivery to MnT to off or on. Also what @Greg Gibbs mentioned, but only have to regenerate the Root CA chain and then the ISE Messaging certificate.