Summary: Endpoints that are rejected multiple times by ISE will continue to get rejected after you fix their settings (MAB or 802.1X) due to RADIUS suppression settings.
Version: ISE 2.2+
Issue: When an endpoint has its authentication attempts rejected by ISE multiple times in a short period, ISE will continue to reject the endpoint for 60 minutes even if the issue causing the rejection is fixed.
Answer: ISE by default will detect hosts that send 2 or more authentication attempts that are rejected in 5 minutes and then suppress them for 60 minutes. During this period all authentication attempts will be rejected for this endpoint without the full authentication process taking place in ISE. This is done to preserve ISE resources against hosts that are misconfigured. The default settings for RADIUS suppression can be changed in "Administration > Settings > Protocols > RADIUS". Here are the default settings:
To manually remove this suppression from an endpoint (2.2+) you can go to Context Visibility > Search for the Host by MAC or IP > Select the Host by clicking its radio box on the left > and then Click “Release Rejected” as scene below:
Note: My picture shows the "Release Rejected" button grayed out because this host is in the "disconnected" state. But if your host is in the "rejected" state (i.e. it is currently connected to a switch and getting rejected) then this button will be available.
Like if this helped!