ISE pxGrid Session interface: Difference between ISE GUI Live sessiosn and pxGrid Sessions?

[hnohre]

When querying the pxGrid sessions interface I get quite a few more entries than I do from the ISE GUI interface (Live sessions).

Upon investigation, it shows that the sessions which also appear in ISE GUI interface are in state STARTED or POSTURE, whereas the sessions retrieved through pxGrid interface also includes sessions in state AUTHENTICATED.'

Many of these sessions from pxGrid that are in state AUTHENTICATED are also very old, some from 6 months back.

I believe I can (in my script) easily filter on this, but it would still be nice to have a pointer to the difference between

sessions that are kept in pxGrid, but now shown in ISE GUI (live sessions).

[hslai]

It's the first I heard of such. Please see if Removing Stale Sessions helps.

[hnohre]

Thanks. I am sure I can remove the stale sessions as per your suggestion.

But is there meaning of the state anywhere documented?

My guess is that the session gets AUTHENTICATED, then to STARTED after accounting start, then back to AUTHENTICATED after accounting stop, or after a timeout??

But I prefer not to guess.

Also what is the expected behaviour wrt ISE purging these sessions? Should they be purged after accounting stop, or after a timeout, or never?

[hslai]

AUTHENTICATED -- after sending the access-accept.

STARTED -- after receiving ACCT start

TERMINATED -- after receiving ACCT stop

Postured -- after receiving a posture report

There are also Authenticating and Authorized but I do not think we using them any longer, because we do not recommend sending epm events via syslog from NAD to ISE M&T nodes.

[hslai]

---

Also what is the expected behaviour wrt ISE purging these sessions? Should they be purged after accounting stop, or after a timeout, or never?

---

Usually accounting stop will terminate the associated session, except for roaming (nas-update). If no accounting, the sessions clear after 1 hour. If accounting received, they clear after 5 days if not further updates.

[hslai · Accepted solution]

The aged authenticated sessions might be due to CSCvi79632.