ISE Radius Live Log Issue

[FY13]

We have an ISE deployment running 2.7 patch 3, and there seems to be some sort of mismatch (I'm guessing) between the MnT nodes, but I'm not 100% sure on that. On some occasions, the Radius Live Log shows all the info you'd expect, like so:

But then, suddenly, it will show something like this:

Only "Authorize Only" methods will be shown.

And it stays like this for 10 minutes or so before changing back to showing all expected info again.

Any ideas how to explain this?

Thanks

[thomas]

The only difference here appears to be the SessionInfo status icons instead of the Pass/Fail/Session icons.

• Auth Passed (Green check): ISE returned RADIUS ACCESS-ACCEPT as result of the policy for a successful WebAuth, CoA, or PAC provisioning.
• Auth Failed (Red X): Returned a RADIUS ACCESS-REJECT as result of policy rule, authentication failure, suppression settings, unknown NAD, etc.
• Session (Blue i): ISE received RADIUS Accounting Start after the Auth Passed. A log line will also be updated upon receiving an interim accounting update.

ISE refreshes your LiveLogs every 10 seconds according to your screen and after a while - "some occasions" as you say - you have a see Pass/Fails rather than only Session updates.

This is probably due to re-authentication intervals and RADIUS interim updates in your endpoint sessions.

Click on the session details icon to see what is happening or filter on a specific endpoint to see it's series of authentication events.

[FY13]

Thanks for replying Thomas. So I tried what you said, filtering on one endpoint, but the result is still the same. It first shows just the Session Info, then 10 minutes later, the Auth Passed records suddenly appear as well.

[hslai · Accepted solution]

This points potentially some issue with the ISE M&T db. Please check the performance data of the MnT node(s) and engage Cisco TAC as needed.