Cisco ISE 2.3 Patch 5 - EAP Session Allocation Failed - 5443 RADIUS request dropped due to reaching EAP sessions limit

[pgiouvanellis]

Hello everyone ,

Since last week i started to get the below errors and alarms on ISE Deployment we have .

We have 2 PAN nodes and 4 PSNs and we used to a wired enviroment for NAC .

The amount of the users is about 15000-20000 .

So last we we get the specific alarma for PSN-2 and we perform a restart of services and now is ok .

This week we get the same alarm fro PSN-3 we know that if we perform service restart is going to be solved but 

does anyone has any idea why we start getting these alarms ? 

Thank You ,

Palaiologos 

[Arne Bier · Accepted solution]

Hi @pgiouvanellis 

What model of PSN do you have?  SNS-3415, SNS-3515 etc?

There are system limits.  I have never seen this error before but given your user count you might be hitting the limit per PSN (and by user count do you mean concurrent users? i.e. is this a session count based on radius accounting in ISE?)

Check this out

https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--1312516075

[Jason Kunst]

I would recommend debugging and seeing if you’re running into a bug with the TAC