Authentication Request repeat count
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-24-2025 04:59 AM
Hi,
Any ideas what would be causing such a high repeat count in ISE?
- Labels:
-
Identity Services Engine (ISE)

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-24-2025 12:52 PM
You might want to disable the Suppression features under Administration > System >Protocols > RADIUS and then watch your Live Logs a bit more closely to see the likely cause. Your screenshot also mentions misconfigured NAD - perhaps it's a device with wrong shared secret, or other misconfiguration. ISE is just suppressing this repetition for you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-25-2025 01:55 AM
Hi, I have a TAC case open with Cisco at the moment but it's been open for quite a few weeks and the suggestions so far have made no difference. The Misconfigured devices are all the same errors which is
12929 NAS sends RADIUS accounting update messages too frequently |
I've tried lots of things to try and fix this but nothing seems to be working.
I seem to be getting lots and lots of authentication requests coming in.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-25-2025 02:29 AM
Maybe your situation is similar? Is this a Cisco FlexConnect scenario?
ISE will only send a CoA to a NAD if ISE believes the session is still active. So either the Accounting Stop was not sent or processed, or more likely is the theory I just explained.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-25-2025 03:08 AM
It does seem to be something like the authentication method is either not clearing and continues to try even though it's successful or like you said the device disconnects or goes somewhere else and the sessions is not cleared down.
I'm not using Cisco Wi-Fi at this time, just 9200 switches.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-25-2025 03:58 AM
I also noticed on my switches that sometimes a high authentication count is due to a faulty endpoint that just reauths because its network stack keeps restarting the 802.1X every few seconds etc. You have no control over that. Sometimes it helps to capture the traffic on such an interface and analyse in wireshark. I have also had faulty media converters inject “noise” on the Ethernet that then triggers ongoing authentication events.
