ISE 3 Seeing non RADIUS Active Endpoints

[mlcsu.ciscosmart1]

We have a strange scenario on our ISE 3 deployment. We have a single WLAN for clients authenticating to ISE with EAP-TLS via a 5520 WLC on v8.2. The WLAN has the ISE deployment as the Authentication and Accounting servers. We have 10 other WLANS that do not ustilise ISE for AAA, however the authentications for these appear in 'Active Endpoints'. I can't figure out how these are appearing in ISE as none of them have accounting pointing to that deployment. Has anyone seen this? Is this normal behaviour and if so - how is ISE getting this data?

[Marcelo Morais · Accepted solution]

Hi @mlcsu.ciscosmart1 ,

 please use the: Operations > Troubleshoot > Diagnostic Tools > General Tools > TCP Dump and

 filter with: ip host <Host IP Addr>

 to check where you are receiving the AuthC request from.

Hope this helps !!! 

[Massimo Baschieri]

Be sure to completely disable authentication and accounting on the wlc for the non 802.1x ssids into security/aaa servers tab