topic How are you authenticating in Network Access Control

Step Latency?

James Horne — Mon, 11 Mar 2019 05:23:31 GMT

Hi, all.

I haven't been able to find anything out about the term "Step Latency" which is seen in the authentication info for a user in ISE. I have been having an issue where wireless clients are being delayed by a failry reliable time (7500ms) on each dot1x authentication, judging by this value.

The issue is of course not knowing what this particular value is or what it relates to. If anyone can define the term or link to a document, I'd be very grateful!

Thanks

As far is i know, the "step"

jan.nielsen — Sat, 31 Jan 2015 18:57:07 GMT

As far is i know, the "step" definition, is just an indicator of how long a specific step of the authentication or authorization process took. So you can see if ex. your Active directory lookup took a long time, or maybe something else is taking a long time. is the one with 7500 the only step in your detailed log that says latency=something?

Thanks, Jan!I had suspected

James Horne — Sun, 01 Feb 2015 23:01:36 GMT

Thanks, Jan!

I had suspected as much but (like the steps themselves) it is not explicitly clear. This is typical of what we're seeing:

11006

Returned RADIUS Access-Challenge( Step latency=7530 ms)

The fact that it's always so close to 7500ms makes it seem unlikely to be a load-type issue, no?

If you or any others here have any insight, I'd appreciate the input. I've managed to find the attached spreadsheet of error/debug/etc. codes for ISE but it doesn't really clarify the process enough for me to isolate the issue.

How are you authenticating

jan.nielsen — Mon, 02 Feb 2015 04:54:38 GMT

How are you authenticating the wireless clients with this issue (AD, Certs, other) ? What authorization conditions are you trying to match them to (Ad groups or other) ?

Sorry for the late reply!

James Horne — Wed, 18 Feb 2015 04:32:49 GMT

Sorry for the late reply!

Authenticating with user credentials (AD) to ISE; AD group membership is the main authorization parameter in use.

It seems like the latency mentioned is more specific to iOS clients and the new 5760 controllers seem to be behaving pretty differently to the 5500s in use prior. We've found some interesing behaviour in ISE with anomolous client detection and a few other aspects but we've as yet not been able isolate the cause with this specific issue.

Thanks again for your initial answer, Jan.

FYIYou have a Cisco ISE

Venkatesh Attuluri — Wed, 18 Feb 2015 10:23:03 GMT

FYI

You have a Cisco ISE bandwidth and latency calculator available for ATP partners , You can download it from ATP Resource Center

http://www.ciscosecurityatp.com/login.asp?strReturn=/index.asp