Hi, Can you advise on how you do the authentication policy on v2.3.   In the example above when creating the 3 rules for the authentication of external, travelling & local user it says set the Allowed Protocols to use proxy service: eduroam & PEAP-Auth but in v2.3 the authentication policy has the "Use" field where you can select internal endpoints, users & ID stores. ... View more

Great article. Can you expand a little on how to register ISE as our RADIUS server with the external RADIUS servers & does this mean ISE needs to be accessible from the internet? ... View more

We are not authenticating users to AD. The latency was occuring during the lookup of the endpoint in the internal endpoint store.   The final fix for this was to add a purge rule to our endpoint store. What had happened was as we are only in the early stages of rolling out ISE & using MAB authentication bypass over the last 6-9 months ISE had been profiling devices & adding them to the "profilled" internal endpoint store. Because we are a university with several campuses in & around a busy city many devices that had been profiled could have been passers by with devices that were seen by our APs, guest devices visiting campus not to mention all the devices owned by students & staff. Our internal profiled endpoint store had grown to over 80,000 devices.   When looking up devices that are part of our static MAB list it first was looking through this profiled list of 80,000 devices before getting to our MAB lists. After putting in a purge rule to remove devices that have been inactive for more than 5 days our profiled endpoint store reduced to less than 4000 devices. This solved the latency issue. ... View more

So we updated to patch 4 the other day & were still getting authentication latency errors. We were also seeing some authentication latency spikes at night around the same time. What we have found since is that some of our authorization policies were set to reauthenticate every 1800 seconds. As we are using MAB authentication at the moment for a lot of devices like cctv, door entry systems, building management systems we have turned off reauth on these & increased the timer on the policies for VLANs that we do want to reauthenticate to 28000 so this will only occur once in the working day.   We are continuing to monitor & will update results. ... View more