ISE radius accounting report

[aous.salloum]

Hey Folks, 

I have a question regarding ISE accounting report, in the account authentication why some of them are showing RADIUS and some are remote, and why the RADIUS one is showing the username in the identity section while the remote one is showing the MAC address in the identity.

screenshot attached.

Many thanks.

[Arne Bier]

Hi @aous.salloum 

Let me guess ... this is for a guest solution?  If so, then the behaviour is expected because MAB authentication in ISE will never return the guest identity in the Access-Accept to the NAS.  It returns the MAC address contained in the original Access-Request.  

If you are using ISE 2.4 then you will likely see the correct guest user's name in the Live Logs and in the Authentication reports.  But at the RADIUS protocol level, we're dealing with MAC addresses all the time.  And this is of course reflected in the RADIUS Accounting :-(

[Jason Kunst]

Right, even if it’s not for guest it’s still an issue and needs a tac case

For remember me issues please attach to remaining defects mentioned in this post

https://community.cisco.com/t5/security-documents/ise-2-3-remember-me-guest-using-guest-endpoint-group-logging/ta-p/3641150

[aous.salloum]

Hi All, thanks for the reply, did you look at the screenshot ? what is the different between RADIUS and remote ? as in the account authentication field.

Thanks

[Arne Bier · Accepted solution]

Hi @aous.salloum 

That is a very interesting observation - I missed that in your original posting.  I just had a look at my lab and I see the same thing.  I only have a singe NAS (Cisco WLC) that is sending RADIUS Accounting.   

I cannot be 100% sure (because ISE Reports don't contain that data) but it seems that if the RADIUS Authentication was a host lookup (e.g. MAB) then the resulting accounting records will be flagged as 'RADIUS'.  If however the authentication was made by AD or such like, then the accounting Report shows "Remote" as the Account Authentication.  

[hslai]

Arne Bier is spot on. See RFC 2866 Section 5.6