IBNS 2.0 with always on IP Phones or CCTV

[rayyaanfayker0006]

Hi

I just got an concern, i have noticed that my Ip phones and cameras that connect via MAB on ISE are in an unauth state after a few days when a run the "Show Access-sessions command".  Currently my ISE Environment is in monitor mode and both ip phones/cameras are working just fine at the moment. What will happen when i enforce? Will my cameras and phones stop working ? 

[Colby LeMaire]

If those devices are passing traffic regularly, then they should not be going into an unauth state.  You can try to do reauthentication (session-timeout) at least every 24 hours.  I recommend doing that anyway so that ISE has an updated list of what devices have been authenticated every 24 hours.

[Greg Gibbs]

In addition to Colby's comments, you should compare your switch configuration against the examples in the Secure Wired Access Prescriptive Deployment Guide paying particular attention to the "aaa accounting update newinfo periodic" and "authentication periodic" commands.

[rayyaanfayker0006]

Thanks Greg and Colby for the info, will do some reading today on the topic.