Is username "dummy" exist by default in ISE used when testing "automate-tester username dummy probe-on"?

[getaway51]

Hi,

Is the password for this CLI "automate-tester username dummy probe-on" needed?

radius server ise

automate-tester username dummy probe-on

key testise

Is "key testise" related to automate-tester username dummy probe-on? 

[Damien Miller · Accepted solution]

"dummy" in the "automate-tester username dummy probe-on" command is an administrator defined username, dummy can be replaced with anything. The user does not need to exist anywhere, the switch is perfectly fine with ISE sending a radius-reject back in response to the probe.

"key testise" is the radius shared secret that the switch uses to communicate with ISE. You set the key "testise" to anything you want, but it has to match on the network device configured within the ISE GUI.

[getaway51]

Hi,

So this "dummy" is not a username configured in ISE. Basically "dummy" is going to fail. 

But the key needs to be correct same like in ISE.

AM i  correct? 

[getaway51]

Hi,

If I check the username dummy(by filter) in the ISE live logs, can I see the failed session for user "dummy"? 

[paul]

By default ISE will not disclose invalid usernames in the RADIUS logs.  You can turn that annoying feature off in the RADIUS settings in ISE.  As Damien said ISE can reject the authentication and the switch won't care as long as it is getting a response.  

I usually setup a policy set for the switch keep alives as I don't like not handling the request properly.  I set the authentication to internal user and set the user not found to Continue.  Then I put in an authorization rule to allow the access with a deny all DACL.  Once I see the successful hits in the RADIUS logs I turn on suppression for the User ID so the switch probes aren't filling up my logs.

[fhowzejr2]

Is it possible to share your authentication and authorization rules in your policy set?  I would like to do this as the "Invalid" errors is filling up the Live logs.

Thanks

[paul]

Skip the policy set and just go to Administration->System->Logging->Collection Filters and setup a new collection filter to Filter All for the username "dummy" or whatever you are using for your switch keep-alive probes.

[fhowzejr2]

Thanks so much, I applied the collection filter and no longer have the clutter in Live Logs.