We are not authenticating users to AD. The latency was occuring during the lookup of the endpoint in the internal endpoint store.
The final fix for this was to add a purge rule to our endpoint store. What had happened was as we are only in the early stages of rolling out ISE & using MAB authentication bypass over the last 6-9 months ISE had been profiling devices & adding them to the "profilled" internal endpoint store. Because we are a university with several campuses in & around a busy city many devices that had been profiled could have been passers by with devices that were seen by our APs, guest devices visiting campus not to mention all the devices owned by students & staff. Our internal profiled endpoint store had grown to over 80,000 devices.
When looking up devices that are part of our static MAB list it first was looking through this profiled list of 80,000 devices before getting to our MAB lists. After putting in a purge rule to remove devices that have been inactive for more than 5 days our profiled endpoint store reduced to less than 4000 devices. This solved the latency issue.
... View more
.jpg "VIP Mentor"){kind=icon}
