High Authentication Latency alarm in ISE

[Arthur Martez]

Hi.

I recently detected the alarm "High Authentication Latency" in ISE. When I check the node latency in System Summary Dashboard it has between 220 ms - 260 ms of latency.

Yesterday the latency went so high (2137 ms) I applied a reload and all went ok after that.

In logs I can the evaluating policy group is taking so long:

Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
15049 Evaluating Policy Group ( Step latency=3961 ms)
15008 Evaluating Service Selection Policy
15048 Queried PIP - DEVICE.Location
15048 Queried PIP - Radius.Called-Station-ID

In all cases I can see internal steps of ISE (AD is not taking place with the latency).

Any idea of what could be causing the latency problem?

ISE Version 2.7.0.356 patch 3.

Thank you.

[Marcelo Morais]

Hi @Arthur Martez ,

 1st please take a look at Building ISE RADIUS Policy Sets (special attention to ISE Policy Optimization and Authorization Policy Optimization).

 2nd please take a look at ISE 2.7 Release Notes (the new Patches from 4 to 7 solved not only some latency issues, but also some memory leak issues)

 3rd please take a look at Performance and Scalability Guide for ISE (special attention to Table 4. Specifications for Different Hardware Platforms and Cisco ISE Deployment Scale Limits). 

Hope this helps !!!

[ahollifield · Accepted solution]

Also Patch 3 is pretty old at this point.  I would recommend applying Patch 7.  Also consider an upgrade to 3.1.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

[Arthur Martez]

@Marcelo Morais , @ahollifield 

Thank you, I will apply ISE patch 7 and see if it solves the problem.