ISE Alarm : Warning : No Authentications in the last 15 minutes

[pnowikow]

Good morning everyone.  Has anyone seen this or know how to fix it?  I'm running 2.3 and plan to upgrade to 2.6 in early January but these emails have to be wrong since we have over 100 NADs in the environment now running ISE.

Alarm Name : 
ISE Authentication Inactivity

Details : 
No Authentications in the last 15 minutes

Description : 
The ISE Policy Service nodes are not receiving Authentication requests from the Network Devices

Severity : 
Warning

Suggested Actions : 
Check the ISE/NAD configuration, check the network connectivity of the ISE/NAD infrastructure.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

Sent By Host : XXXXX

[andrewswanson]

Hi

You could be running into the bug below:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz52877/?rfs=iqvred

it is listed as fixed with 2.3 patch 6

hth

Andy

[Damien Miller · Accepted solution]

This alarm is triggered when an ISE PSN node doesn't receive a RADIUS auth over a period of 15 minutes. This would be common if you use one ISE server as primary, and another as secondary everywhere. The secondary might see no authentication and then trigger this alarm. The other option is in TACACS only deployment, if there is no RADIUS, then the nodes will trigger this alarm. In TACACS only deployments I just turn this alarm off.

What andrewswanson also pointed at was the chance of a deployment bug also causing this. If you know that the node generating this alarm is in fact receiving RADIUS auth, then an issue collecting or processing the logs will also cause this to trigger. Patching, then TAC would be your two options at that point.

[stayd]

Hi Damien, what if I do not want to turn off this alarm completly, but I would like to extend the interval of monitoring from default settings of 15 minutes to my own interval, let´s say 60 minutes instead of 15 minutes.

I did not find the way how to set this, because when I am looking on the option of the triggering this alarm, I am lost, look at this yourself:

???

[Kacker]

What is the solution for the primary/secondary trigger? Do you also suggest disabling the alarm from the secondary, or is there a best-practice for configuring the secondary for RADIUS auth?

[Sergio C]

Hello all. I have this issue myself (as during the nights there are low to no authentications) and wanted to change the window to 30/60 minutes. When I try it it says that the Threshold is invalid as it is negative.

I imagine that if I put a valid value there (0) it will not work correctly, as it should be something like 5 and Lesser than instead of Greather than.

[stayd]

Yes this is not well documented. Nobody (excluding Cisco itself) knows what these values stand for.