cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1605
Views
2
Helpful
7
Replies

In Cisco ISE, Live logs appears but In Endpoint that stopped appearing

pgore
Level 1
Level 1

We are in ISE 3.2.0.542 patch 3. Suddenly when i added new switch and deployed ISE with monitor mode. 

Live logs shows up device but Endpoint profile shows blank in it

and If i go to context visibility > endpoints. These endpoints arent present there. These wasnt the case few days back when  any endpoint once configured with ISE appears in live logs first and then same

 
7 Replies 7

balaji.bandi
Hall of Fame
Hall of Fame

Can you share screenshots 

MHM

Are those sessions you see in live logs failed sessions? Endpoint profiles would not show up for the failed sessions. If that is not the case probably I would try to reset the context visibility database. You can do so by issuing the command "application configure ise" and then select the number of the "Reset Context Visibility" which should be number 20.

this worked for me!

TY Aref

pgore
Level 1
Level 1
  • We are in ISE 3.2.0.542 patch 3. Suddenly when i added new switch and deployed ISE with monitor mode.

Live logs shows up device but Endpoint profile shows blank in it. ideally first it used to profile something atleast based on mac OUI or start digits or unknow now its completeely blank

and If i go to context visibility > endpoints. These endpoints arent present there. These wasnt the case few days back when  any endpoint once configured with ISE appears in live logs first and then same appears in endpoints too but now its not the case and need help

we even tried context synch by no 21 and also later reloaded the Admin node but didnt solve issue

And there is no delay in live logs they appear immediately

And irrespective if auth fail or pass the end point gets registered and appears before now it doesnt ...

So still looking for solution..tried reload of Admin node didnt fix that as well

Were you able to get this resolved? If so, what did you do?

Can you please try to remove an endpoint manually and see if that makes any difference? if not, I would recommend raising a TAC for this.