View Blacklisted Endpoints by Client Suppression Feature

[umahar]

We have enabled anomalous client suppression with Reject RADIUS requests from clients with repeated failures checked.

Is it possible to view the blacklisted endpoints on ISE due to repeated client failures ?

[Craig Hyps]

On the ISE Home Page, you will see a counter for "Rejected Endpoints".  You can click on this to bring up list, or view Rejected endpoints in Context Visibility and have option to choose all or specific endpoints and "Release Rejected".  

[umahar]

Thanks Craig

Which ISE versions are these features supported from ?

Also the API support where we can release rejected endpoints

[Craig Hyps]

In ISE 2.2 we display and allow release of suppression-Rejected Endpoints.  API also added in 2.2.  See BRKSEC-3699 (reference version) from CiscoLive Orlando 2018 (available on CiscoLive.com) for more info with screen shots. Search on "Visibility into Rejected Endpoints"

Example ERS API:

• https://ise22-pan1.cts.local:9060/ers/config/endpoint/getrejectedendpoints
• https://ise22-pan1.cts.local:9060/ers/config/endpoint/7C:6D:62:E3:D5:05/releaserejectedendpoint