Difference between suppress & reject Cisco ISE?

[Mottok]

Hi, can anyone tell me exactly what the difference between suppress and reject is please? Because when you look at the info it says 'Suppress' is to supress from audit logs AND to reject, and to reject is to reject......eh??

Can't find much on interweb either.

Any help appreciated thanks.

[Mottok]

Hi - anyone able to answer the above? Thanks.

[Aravind Ravichandran]

Hi,

Please refer this document for client suppression:

 https://community.cisco.com/t5/security-documents/configuring-anomalous-client-suppression-on-ise/ta-p/3161437

[Mottok]

Ok thanks, so it basically looks like the suppress keeps it out of logs and reject actually stops/rejects authentication. Just the supress part which is badly worded in the "i" info section.

[Aravind Ravichandran]

Yeah Suppress will reduce the repeated logs & reject will stop the failed authentication of endpoint for mentioned time period.

Thanks,

Aravind

[Mottok]

yeh it's just that last sentence about the suppression that was confusing me, it looks as if this could reject too. Thanks all.

[ammahend · Accepted solution]

Suppress as per your config means if the client has failed authentication 2 times in 5 minutes, then don't report failure in logs everytime the client failed after first 2 times, only report it every 15 minutes once.

Reject as per your config means after total 5 failures, don't process client request for authentication for 60 minutes.

[Mottok]

Was looking for a nice simple answer and that's it thanks!