What to find all failed devices during monitor mode?

[getaway51]

Hi,

I checked in 3 places for failed devices during monitor mode. However most of the time, i found too many logs and not really sure where to look exactly to determine if an endpoint was "deny access" due to default identity grp. So i look manually one by one mac address and cross check in radius logs and context visibility. This took a long time even for a single devices. 

I would like to knw how to quickly and most accurate way to chk the failed devices(which mostly due to def identity grp or other reasons) so tht i can add them into the correct identity grp. 

[howon · Accepted solution]

One option is to instead of failing endpoints, create a catch all policy rule that sends back authorization profile named "FAILED" but instead of sending back ACCESS-REJECT send back simple ACCESS-ACCEPT. This way, you can easily create report based on the authorization profile called 'FAILED'. Caveat is that the live log and ISE report will no longer mark failed authentication with red entry but you can easily filter it by authorization profile name.

[getaway51]

Hi,

I dont quite understand but is there any other way which already available tht dont need configuring ISE?

After I turn ON monitor mode, I just need to find those failed devices so tht I can add their MAC address in CV identity group. 

[getaway51]

Hi,

I understood there are too many ISE logs and live sessions every 10sec, is there a way to quickly identify the latest failed devices after configuring "monitor mode" especially for MAB devices?

Where is the best place and method to achieve these?

[Parag Mahajan · Accepted solution]

Export all endpoints in context visibility. Apply filter for authorization rule with name of default rule and network device.

[getaway51]

Hi,

Context visibility only will show all the latest updated result? Will it include any historical value as well?

[hslai]

Context visibility is not currently designed to keep historical results. Please run a RADIUS authentication report instead.