topic Re: Difference between suppress & reject Cisco ISE? in Wireless

Difference between suppress & reject Cisco ISE?

Mottok — Mon, 05 Jul 2021 16:09:57 GMT

Hi, can anyone tell me exactly what the difference between suppress and reject is please? Because when you look at the info it says 'Suppress' is to supress from audit logs AND to reject, and to reject is to reject......eh??

Can't find much on interweb either.

Any help appreciated thanks.

Re: Difference between suppress & reject Cisco ISE?

Mottok — Mon, 15 Oct 2018 11:38:25 GMT

Hi - anyone able to answer the above? Thanks.

Re: Difference between suppress & reject Cisco ISE?

Aravind Ravichandran — Mon, 15 Oct 2018 13:21:15 GMT

Hi,

Please refer this document for client suppression:

https://community.cisco.com/t5/security-documents/configuring-anomalous-client-suppression-on-ise/ta-p/3161437

Re: Difference between suppress & reject Cisco ISE?

Mottok — Mon, 15 Oct 2018 13:30:14 GMT

Ok thanks, so it basically looks like the suppress keeps it out of logs and reject actually stops/rejects authentication. Just the supress part which is badly worded in the "i" info section.

Re: Difference between suppress & reject Cisco ISE?

Aravind Ravichandran — Mon, 15 Oct 2018 13:42:46 GMT

Yeah Suppress will reduce the repeated logs & reject will stop the failed authentication of endpoint for mentioned time period.

Thanks,

Aravind

Re: Difference between suppress & reject Cisco ISE?

Mottok — Mon, 15 Oct 2018 13:47:07 GMT

yeh it's just that last sentence about the suppression that was confusing me, it looks as if this could reject too. Thanks all.

Re: Difference between suppress & reject Cisco ISE?

Ambuj M — Mon, 15 Oct 2018 15:09:44 GMT

Suppress as per your config means if the client has failed authentication 2 times in 5 minutes, then don't report failure in logs everytime the client failed after first 2 times, only report it every 15 minutes once.

Reject as per your config means after total 5 failures, don't process client request for authentication for 60 minutes.

Re: Difference between suppress & reject Cisco ISE?

Mottok — Mon, 15 Oct 2018 15:13:08 GMT

Was looking for a nice simple answer and that's it thanks!