ISE - proactive with fault management help

[mellwang]

all,

I have a healthcare system installing DNAC/SDA (AS and Partner)  in a new tower.   ISE-DNAC integration caused an outage with wireless users.   Customer would like to be proactive with fault management so they can detect, isolate , and correct any potential ISE-DNAC integration issues and avoid future outages.   Are there any Syslog messages, traps, MiBs, etc,  that can be monitored for early detection ?    Even though ISE and DNAC integration is in early stages, there has to be some thresholds or messages that can be monitored for early detection.  

[Aravind Ravichandran]

Hello,

First of all, if DNAC and ISE integration breaks, it has nothing to cause outage related to AAA.

DNA-C and ISE is integrated via pxGrid through trust based on certificate and password.

ISE will share the context and SGTs via pxgrid and DNA-c will do ERS API to add network devices in ISE and configures east-west segmentation policies.

If pxGrid service is down, you will get alert as process down alert(can get via syslog/email) & exciting things will work as it is. As Network device and ISE will communicate each other for any authentication request/to download any CTS environment data.

-Aravind

[mellwang]

The integration with ISE and DNA Center dynamically updated a certificate within ISE which then prevented wireless users from Authenticating.   It was bug CSCvk74989 and the SR is 685316245.   

The customer has implemented a manual work around for now but would like to be proactive to prevent another outage.  All they are asking is how and what can they manage.   

[Aravind Ravichandran · Accepted solution]

Hi,

Under Administrator >System>Settings>Alarm settings>Alarm configuration. You can configure Excessive Failed RADIUS Authentication Attempts alert where you can mention 'n' number of failed attempts in '15-60' number of minutes. Also you can mention the Network device IP (WLC IP).

-Aravind