topic Re: Limit authentication requests per network device on ISE in Network Access Control

Limit authentication requests per network device on ISE

syllkons1 — Thu, 16 Oct 2025 09:32:47 GMT

Hello all,

Is there a way to limit the authentication requests per network device on ISE?

We already use "Suppress Repeated Failed Clients" under RADIUS but this applies per endpoint.

If an attacker generates hundreds of different mac addresses, ISE is still at risk.

This can be limited on the network device, which we do, but I was wondering if that is an option on ISE as well.

BR,

Konstantinos

Re: Limit authentication requests per network device on ISE

Arne Bier — Thu, 16 Oct 2025 21:22:32 GMT

Hi @syllkons1

I don't know of any ISE feature that would protect. The PSN just takes any request that you throw at it - apart from the "reject on repeated failed attempts" etc.

Maybe a load balancer front-ending your PSNs could be scripted to detect some kind of attack. e.g. an F5 iRule

Other approaches with ISE could involve dedicating PSNs to a certain role only (e.g. wired RADIUS, vs wireless RADIUS) - can become expensive, but it would "protect" your other PSNs.

Just out of interest, how have you limited the requests on the network devices (in your last sentence) ?

Re: Limit authentication requests per network device on ISE

syllkons1 — Sat, 18 Oct 2025 16:21:32 GMT

Hey @Arne Bier ,

I understand it makes sense that ISE would accept the requests as valid if they are coming from different clients.

We have configured "radius-server throttle" on the switches.