ISE 2.1 - 12929 NAS sends RADIUS accounting update messages too frequently

[N3t W0rK3r]

Our ISE server is alarming with the above error message for radius messages coming from our WLC.  The WLC is a 5520 running 8.2.166.0 code.

In the WLC GUI,  I reviewed the AAA settings on one of popular SSIDs and I saw that the interim update was enabled and the interval was set to 0 originally.  Not sure what a zero value means in this context or even what the unit of measure is for that field since its not displayed, but we decided to change it to the apparent default of 600 secs.  This did not seem to have an impact on the alarm reported in ISE.

Sample ISE alarm contains following details:

Message: NAS conducted several failed authentications of the same scenario

Failure count: 24133

Failure Duration: 889:09:57

Failure Reason: 12929 NAS sends RADIUS accounting update messages too frequently

Question is, is this normal?  That count and duration seems quite high.  Is this a bug?  Should I even have interim updates enabled on the WLAN? What is the implication of disabling it?  Not really sure where to go from here, so I'm looking for guidance from the community here.

Thanks in advance.

John

[Mohammed al Baqari]

Hi,

The message 'NAS sends RADIUS accounting update messages too frequently'
can be caused for too many reasons such as flapping port, Open SSID, etc.
In your case its failed authentications. You need to look at the syslogs
generated from WLC related to dot1x authentication and see why you are
having too many authentication failures. It can be a miss configured client
which is usually the case.

Now the implications that this increases the size of MNT database due to
large amount of accounting logs. Also, in some instances it can cause high
cpu in MNT and if its hosted with PAN, then it can be an issue.

One option can be useful here is radius accounting suppression

[N3t W0rK3r]

Thank you Mohammed.

Can you please expand on what you mean by radius accounting suppression?  Are you suggesting that I actually disable accounting on the SSID?

Thanks.

John

[Arne Bier · Accepted solution]

I have been through the mill on this topic as well and never got a really clear answer from Cisco.  To give you an example, on a network of say 5 active guest devices I was getting the same errors as you.  There is no way that I was getting many accounting messages because interim update was set to 0.  I think there is an integration timer and if more than x number of messages are seen in time y then ISE starts to panic and complain about it.  The values of x and y are probably not sensibly set by default.

Have a look at this thread over in the ISE Community sister forum

https://communities.cisco.com/thread/85221

[N3t W0rK3r]

Thank you Arne... very helpful.

Cheers.

[egodalisse]

Hi,

We have the same issue here. ISE 2.1 complains about too many accounting messages from NAS for both the WLC's (version >8)  and the wired switches (3750x for instance running 15.0(2)SE6 or 15.0(2)SE7).

On the WLC settings we do have the interim update set to 0.

On switches we have the below accounting config :

aaa accounting update newinfo periodic 2880
aaa accounting dot1x default start-stop group ISE-RADIUS

Regarding switches I can observe using the debug radius accounting that these messages are sent every 4 or 5 sec for ports that authenticated the endpoints using MAB.

Any idea ?

regards

[PlanaRamirez]

Thank you Arne for your advise,

While checking your solution I could not reach this thread due to some sort of mispelling in the link provided.

Looks like you have to follow this threat if apply:
https://community.cisco.com/thread/85221

that leads to:
https://community.cisco.com/t5/identity-services-engine-ise/ise-alarms-misconfigured-network-device-detected/m-p/3420973

Yours,
Alfred