cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2017
Views
10
Helpful
3
Replies

ISE Radius Live Log Issue

FY13
Beginner
Beginner

We have an ISE deployment running 2.7 patch 3, and there seems to be some sort of mismatch (I'm guessing) between the MnT nodes, but I'm not 100% sure on that. On some occasions, the Radius Live Log shows all the info you'd expect, like so:

 

ISE_LOG_ALL.png

 

But then, suddenly, it will show something like this:

 

ISE_LOG_AUTH_ONLY.png

Only "Authorize Only" methods will be shown.

And it stays like this for 10 minutes or so before changing back to showing all expected info again.

 

Any ideas how to explain this?

Thanks

1 Accepted Solution

Accepted Solutions

hslai
Cisco Employee
Cisco Employee

This points potentially some issue with the ISE M&T db. Please check the performance data of the MnT node(s) and engage Cisco TAC as needed.

View solution in original post

3 Replies 3

thomas
Cisco Employee
Cisco Employee

The only difference here appears to be the SessionInfo status icons instead of the Pass/Fail/Session icons.

  • Auth Passed (Green check): ISE returned RADIUS ACCESS-ACCEPT as result of the policy for a successful WebAuth, CoA, or PAC provisioning.
  • Auth Failed (Red X): Returned a RADIUS ACCESS-REJECT as result of policy rule, authentication failure, suppression settings, unknown NAD, etc.
  • Session (Blue i): ISE received RADIUS Accounting Start after the Auth Passed. A log line will also be updated upon receiving an interim accounting update.

ISE refreshes your LiveLogs every 10 seconds according to your screen and after a while - "some occasions" as you say - you have a see Pass/Fails rather than only Session updates.

This is probably due to re-authentication intervals and RADIUS interim updates in your endpoint sessions.

Click on the session details icon to see what is happening or filter on a specific endpoint to see it's series of authentication events.

Thanks for replying Thomas. So I tried what you said, filtering on one endpoint, but the result is still the same. It first shows just the Session Info, then 10 minutes later, the Auth Passed records suddenly appear as well.

ISE_LOG_AUTH_ONLY_FILTERED.png

ISE_LOG_ALL_FILTERED.png

hslai
Cisco Employee
Cisco Employee

This points potentially some issue with the ISE M&T db. Please check the performance data of the MnT node(s) and engage Cisco TAC as needed.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers