Accounting detail report

[mamckenn]

Hi,

I've noticed something strange on the ISE livelogs and wondering if it's a bug or a feature. On some of my Session ()  entries on the livelog i get Authentication details, whereas others are showing me Accounting details.

I thought the Session entry should always be Accounting details, whereas the 'Auth Passed' entry should be Authentication details. 

This endpoint displays Authentication detail report even for the session entry, so  I cannot see the Accounting report:

(and yes, when i click on it, it is indeed showing the Authentication detailed report not the Accounting detailed report)

Whereas the entry for a different endpoint gives me the accounting report as expected:

So what is going on? Why can't i see the accounting report for some endpoints on the livelog.

(If i run a radius accounting report i can see all my accounting messages as expected, so they are definitely arriving at my ISE server.)

[Marcelo Morais]

Hi @mamckenn ,

 at Operations > RADIUS > Live Logs there is an Event column with the Session State.

 The Session State could be: Authenticated, Started, Postured and Terminated ... any difference on the Session State when the Detail Report is Authentication vs Accouting?

Regards

[mamckenn]

Hi, all the successfully authz'd sessions that have accounting detailed report available are showing 'Session state is authenticated' under event, whereas those sessions that only have the authentication detailed report are showing 'session state started.'

[Marcelo Morais]

Hi @mamckenn 

 the Session State:

• Authenticated
  ISE accepted the Session, but did not receive RADIUS Accounting Start. Aside from misconfiguration, typical reason to see Authenticated status is for RADIUS Keepalive Requests or Passive ID without matching MAB/802.1X sessions. If no Accounting Start message is received, the session will be removed after 1 hour.
• Started
  ISE received RADIUS Accounting Start. Unless Posture is used, most of the Sessions should show up as Started. ISE requires Interim Accounting message to be sent within 5 days, if not the Session will be removed.

[hslai]

@mamckenn : @Marcelo Morais is correct.

What you are seeing is expected in ISE 3.x. I just updated the further problem description section of CSCvz26295 and it would take 1 ~ 2 business days for review, so I copied the text here:

---

When the live session is in authenticated state, authentication detail report opens and when the same session has processed an accounting event successfully, accounting detail report opens.

---