Alarm Name : ISE Authentication Inactivity Details : No Authentications in the last 15 minutes

[Ditter]

Hi to All,

I think that a lot of discussion has been around this "No Authentications in the last 15 minutes" and as i noticed int he bug reporting tool this would be fixed in ISE 2.4(357) , however i have this version and the message is still active. I also changed the Radius settings under Administration --> Settings --> Protocols --> radius from 15 minutes to one hour but i do not think that it is the correct setting.

So the question still remains: Is thre a way to reduce these inactivity authentication messages?

Thank you,

Ditter

[Ditter]

Just bouncing the thread!

Any noew of how to suppress this kind of message. I am running ISE 2.4(357)

[vthaluru]

Hi Ditter,

Just check have you selected the log collector for passed and failed authentication on logging categories.

If you are not selected ,then please select it and it  will stop.

Thanks

VenkataKrishna

[Ditter]

Hi  VThaluru,

the logging was as you can see in the attached image. I now selected log collector for both passed and failed notifications.  I will let you know if something changes.

Thanks a lot.

[Ditter]

Hi, unfortunately nothing changed after selecting logcollector for both passed and failed logins.

The messages keep coming every 15 minutes:

Alarm Name :
ISE Authentication Inactivity

Details :
No Authentications in the last 15 minutes

Description :
The ISE Policy Service nodes are not receiving Authentication requests from the Network Devices

Severity :
Warning

One thing i noticed is that the Failed and Passed attempts have as severity INFO, but in our case the severity is Warning, thus we are talking about a different parent category.

[Ditter]

So are we still hitting the bug CSCuz52877 even in ISE 2.4 (357) ?

[Steve Dussault]

I am also seeing this issue in release 2.4(0.357).

[hpenley]

I'm still getting the warning notification.

[hslai · Accepted solution]

Go to the Alarm Settings page, select this alarm, edit its status to disable, and save.

[Jetpack]

Worked great for this.
I wish I could do this for the certificate expired. Have one that kicks out that warning for a certificate that doesn't exist. Can't figure out where that ghost certificate is/was because it isn't listed in the GUI.

[mumustha]

Hi Jetpack,

You could reach out to Cisco TAC to clear the expired certificate from the ISE DB if not present in the ISE GUI.
Disabling the ISE certificate expiry alarm will not be the best way forward as usable certificates may also fall in this category.

[Thomas Hontz Jr]

Also you probably won't be able to upgrade with the ghost certificate.  I ran into this problem a while back.  TAC will be able to clear it for you.  

[fabianwickman]

Hi, We are seeing this alarm in 2.7 patch 3.

Should you really disable the alarm? Is it just cosmetic? What if there is an issue that needs to be fixed in the network?

[Damien Miller]

Under normal deployment functions it can certainly indicate a major problem if it suddenly starts. The reason this alarm is generated is because there is no radius authentication hitting a node, or the logging from that node has failed. This could indicate a network reachability issue, a load balancer issue, or something internal to ISE. 

False positives are common if all your authentication uses the same node as primary. The secondary may report this alarm since nothing is configured to use it it unless the primary is down. If the load is balanced across the primary and secondary (or more nodes), then assuming radius hits the nodes at least once every 15 minutes, the alarm will not be triggered. 

Disabling it is common since many use a primary/secondary, I suggest balancing the load either way.