ISE authentication & accounting

[jlaw2@cisco.com]

Can ISE support accounting and authentication messages going to different PSN (part of the same node group) or is license count (acct start/stop) impacted?

Have an escalation from the customer who has been experiencing low license consumption.  Validated that one a specific endpoint was authenticated & there was no accounting event.  Customer performed packet traces and can see the PSN receiving authentication & accounting messages.

[kthiruve]

Hi John,

Session count is tracked using accounting starts and stops.

Here is the ordering guide that will provide further information on license consumption in Table 5.

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

That said, please continue work with TAC so not as to derail the analysis and investigation.

-Krishnan

[Jason Kunst · Accepted solution]

Accounting and authentication should be sent to the same policy service node if it’s not then you’re going to get erroneous behavior