RADIUS session on ISE stuck in "Started"

[milos_p]

Hi guys,

I am testing ISE with EAP-TEAP with chaining.

I am experiencing strange behavior, every second/third time when I shutdown PC, session on ISE is staying in "Started" and not getting "Terminated.

To be precise, session from "Started" on user account, moves to "Started" on computer account.

I am checking at the same time, and session is being terminated on the switch.

Also, from the Live sessions window, you can see that "Accounting stop request" is seen, first for user account and then for computer account (it is TEAP chaining), but state doesn't move to Terminated.

Anybody experiencing same thing, and have some workaround/fix for this?

[Marcelo Morais]

Hi @milos_p ,

 please check the following: CSCvx43825 - Receiving acct stop without NAS-IP address keep session in started state.

Known Fixed Releases
3.0.0.458-Patch3
2.7.0.356-Patch4
2.6.0.156-Patch10

Hope this helps !!!

[milos_p]

Hi Marcelo,

This is very helpful, I thought it is something bug related on Cisco ISE.

I am running 3.1 so, there is no bugfix for now, hope it will come soon.

What is interesting is that I noticed this behavior only on shutdown when user is logged into Widows (Windows 10 with TEAP machine+user chained).

If computer is on logon screen, I shut it down and it terminates the session always.

Problem seems to arise when user is logged in and I perform shutdown.

In that case, sequence in the logs is like this:

1. User logged and I press shutdown -> For a short period, there is accounting stop for user and state falls to Started for machine auth

2. Computer is shutdown after few seconds -> There is another accounting stop for the machine as well, which sometimes works and sessions gets "Terminated" or it gets stuck in "Started".