Hi Folks,
I have Cisco ISE in my network, and currently its running normally with IOS version V12.0 à V15.0, however I had tried to add several SWs 3560x with IOS V15.2, but it didn’t join ISE,
I have included some details below, and I hope you can support me figuring out why I’m seeing the both A/B ISE in Dead state.
- Device: WS-C3560X-48P-S, version 15.2(4)E4 & SW image C3560E-UNIVERSALK9-M
- The SW is working as a L2 Access SW and handling the L2 switching only with Vlan 200 as management.
- The SW is added to ISE and all the keys are correct from both ISE and SWs ends.
- The SW is showing both ISEs (HA system) as Dead
IQBGJAF4-SW01#sho aaa servers
RADIUS: id 4, priority 1, host UNKNOWN, auth-port 1645, acct-port 1646
State: current DEAD, duration 93912s, previous duration 0s
Dead: total time 93912s, count 0
Quarantined: No
Authen: request 4, timeouts 4, failover 0, retransmission 3
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 1
Throttled: transaction 0, timeout 0, failure 0
Author: request 0, timeouts 0, failover 0, retransmission 0
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Throttled: transaction 0, timeout 0, failure 0
Account: request 4, timeouts 4, failover 0, retransmission 3
Request: start 0, interim 0, stop 0
Response: start 0, interim 0, stop 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 1
Throttled: transaction 0, timeout 0, failure 0
Elapsed time since counters last cleared: 1d2h5m
Estimated Outstanding Access Transactions: 0
Estimated Outstanding Accounting Transactions: 0
Estimated Throttled Access Transactions: 0
Estimated Throttled Accounting Transactions: 0
Maximum Throttled Transactions: access 0, accounting 0
Requests per minute past 24 hours:
high - 2 hours, 2 minutes ago: 0
low - 2 hours, 2 minutes ago: 0
average: 0
RADIUS: id 6, priority 2, host UNKNOWN, auth-port 1645, acct-port 1646
State: current DEAD, duration 88671s, previous duration 0s
Dead: total time 88671s, count 0
Quarantined: No
Authen: request 0, timeouts 0, failover 0, retransmission 0
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Throttled: transaction 0, timeout 0, failure 0
Author: request 0, timeouts 0, failover 0, retransmission 0
Response: accept 0, reject 0, challenge 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Throttled: transaction 0, timeout 0, failure 0
Account: request 0, timeouts 0, failover 0, retransmission 0
Request: start 0, interim 0, stop 0
Response: start 0, interim 0, stop 0
Response: unexpected 0, server error 0, incorrect 0, time 0ms
Transaction: success 0, failure 0
Throttled: transaction 0, timeout 0, failure 0
Elapsed time since counters last cleared: 1d37m
Estimated Outstanding Access Transactions: 0
Estimated Outstanding Accounting Transactions: 0
Estimated Throttled Access Transactions: 0
Estimated Throttled Accounting Transactions: 0
Maximum Throttled Transactions: access 0, accounting 0
Requests per minute past 24 hours:
high - 0 hours, 34 minutes ago: 0
low - 0 hours, 34 minutes ago: 0
average: 0
- The configuration related to ISE from SW end is
radius server ISE1
address ipv4 x.x.x.x auth-port 1812 acct-port 1813
timeout 15
automate-tester username ise probe-on
key xxxxx
radius server ISE2
address ipv4 x.x.x.y auth-port 1812 acct-port 1813
timeout 15
automate-tester username ise probe-on
key xxxxx
username ise password xxxx
!
aaa group server radius ISE
server name ISE1
server name ISE2
deadtime 1
!
aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa accounting dot1x default start-stop group ISE
aaa server radius dynamic-author
client x.x.x.x server-key xxxx
client x.x.x.y server-key xxxx
ip device tracking
ip device tracking probe delay 10
ip http server
ip http secure-server
dot1x system-auth-control
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server deadtime 1
radius-server vsa send accounting
radius-server vsa send authentication
!
epm logging
logging monitor informational
ip radius source-interface Vlan200
logging origin-id ip
logging source-interface Vlan200
logging host x.x.x.x transport udp port 20514
logging host x.x.x.y transport udp port 20514
snmp-server host x.x.x.x traps version 3 auth ISEUSER
snmp-server host x.x.x.y traps version 3 auth ISEUSER
!
snmp-server view ISE iso included
snmp-server group ISE v3 auth read ISE
snmp-server user ISEUSER ISE v3 auth sha xxxx
!
snmp-server trap-source vlan200
snmp-server enable traps snmp linkup linkdown
mac address-table notification change
mac address-table notification mac-move
snmp trap mac-notification change added
snmp trap mac-notification change removed
I look forward to having your support.
Thanks in advance
Regards,
Nabil
