Cannot use Cisco ISE Session Trace tool due an error message

[rezaalikhani]

Hi all;

Consider the following example:

When I click on the Run button, the following error message appears:

I am using ISE 2.7 Path 6.

Any ideas?

Thanks

[Arne Bier]

I don't think this is a generic issue with ISE 2.7 patch 6 - I just did a basic test on the exact same version and patch and it works for me.

Well, I say it "works" but it doesn't pass the test I was expecting. At least I don't get any errors like you're experiencing.

Teh trouble I have with this feature is that I find it hard and cumbersome to put all the correct attributes in - it takes ages and it's error prone. For one, I can't see any option to specify the UDP Source IP address (of the NAS) sending the request. Perhaps I am mistaken, but ISE doesn't process the NAS IP Address attribute - it relies on the source IP address of the UDP packet.

I am wondering why you chose the specific RADIUS attributes to go into your test? Did you take these attributes from a tcpdump? Have you seen those exact attributes in a real RADIUS Access-Request ?

Stab in the dark - perhaps the MAC address should be delimited with ":" instead of "-" ?

I have given up trying, even after I took a wireshark capture of an Access-Request (EAP-TLS) ... there are too many Cisco AVPs in there - I don't think those are relevant to the ISE Policy Set processing. The ones that are important in my experience are

Source IP Address of RADIUS packet

User-Name

Calling-Station ID

Service-Type

NAS-Port-Type

[rezaalikhani]

I have generated the above output directly from Live Log, as you can see below:

As you can see, it refers to a log. where is the log to investigate it more for troubleshooting?

Thanks again.

[Arne Bier]

Thanks for that tip - I hadn't realised it was so simple!  However, when I run that against a session that is active (and passed a specific Policy Set), then the feature tells me that the auth wouldn't pass. But it does. I think that is why I gave up on this feature years ago. I just don't get it.

As for the logs - you will have to study this document here and take an educated guess at which log the results can be found in. TAC would usually know the answer. The would enable DEBUG level for the relevant component, and then reproduce the "problem scenario". At the end you should always turn the logging level back to the default. ISE write a lot of logs and it could impact your system.

I can try various examples from Live Logs but I always get the same result ... and the results are not what happens in reality.

[Arne Bier]

@rezaalikhani - did you ever get this working? I have tried in ISE 2.7 (latest patch) and ISE 3.0 latest patch and neither of them produce a working solution. If I had the time I would raise a TAC case to get answers. I doubt this ever worked.