One of the things that surprised me initially when I started working with ISE, is that ISE does not process RADIUS requests based on what the contents of NAS-IP-Address attribute contains - because the RFC 2865 uses makes it sound like this is the IP address the RADIUS server should be re-acting on:
Instead, ISE ignores the NAS-IP-Address, and instead, takes the Source IP Address of the UDP packet - that is the lookup value into ISE's Network Devices database to see perform the shared secret processing etc. And that then forms the basis of the Live Logs displays - whatever you called the Network Device (as a /32 or /whatever) is what will be displayed in the Live Logs.
Perhaps we should submit a Feature Request to have an additional "NAS IP Address" column available - it's there in the Request Details page, so it should be an easy programming job to add this to the list of columns to display.
Whether to use the NAS-IP-Address or the UDP SRC IP to processes RADIUS requests probably has pros and cons - if customers use NAT then this will probably have some implications, because the "true" NAS-IP-Address will not match the NAT'd UDP SRC IP.
My personal preference is to never use anything other than a /32 for the ISE Network Devices for the simple reasons
1) You can clearly see which device sent the request and don't need to dig into the details to see the true SRC IP
2) You know 100% which devices are out there on a subnet.
3) ISE supports tens of thousands of NAD entries. No need to be shy
Regarding point 2, I have a customer migrating from one RADIUS system to ISE, and the person who implemented the previous system used /24 and even /16 in some cases. The system has been in place for many years - no documentation. What a disaster. How would I accurately know what devices are in those subnets? Even if I can ping them, I would have to check each one to see if it's a network device that requires ISE RADIUS services. And I refuse to add those /16 into ISE, because in most parts, it overlaps with my existing /32 definitions - hence, it will be a shambles. People don't think about the long term effects of these poor decisions.
