ISE 3.2 Repeat Count Details

[marco.merlo]

Hi,

on ISE 2.4 in the live logs pages the report that one got clicking on the repeat counter was very useful because the endpoints were sorted by repeat counters. So it was very easy to find the endpoints with high repeated counters.

With ISE 3.2 the report is still present but the the sort key is another one so the endpoint with multiple repeated counters are indeed not shown.

Has anyone else noticed the same issue?  

Regards

M

[Arne Bier]

can you please put some screenshots in the discussion?  I tried to follow your comments, but I can't find what you're referring to exactly.

[marco.merlo]

Hi Arne,

please refer to the attached video. On ISE 2.4 after clicking on "Repeat Counter" the resulting report used to show  "top talkers" endpoints at the top of the list so it was very easy to find the endpoints that performed an anomalous number of authentications.

Regards

M

[MHM Cisco World]

last week I study about ISE (advanced) and see these two slides check it

[Arne Bier]

Ok. I checked on my ISE 3.2p5 setup and It's sorting the top talkers in descending order (highest to lowest) repeat count. There is no sort by column option. Looks alright. I built that system clean from ISE 3.2 (no upgrades).

In your video it shows a large repeat counter - I have to assume that you have Suppression enabled under Administration > System > Protocols > RADIUS ?

Because on other systems where this is disabled, the Repeat Details page looks like yours (0 Repeats) - I guess that is obvious in cases where Suppression is disabled. But that is all I can think of. Perhaps this is a TAC case? They might tell you to run some of those CLI commands on the PAN to sort out the MNT/Session Database. 

[marco.merlo]

Thank you very much.

I have patch 4 installed so far because we are waiting for patch 6 in order to solve 

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi42628 (this buf fill  costed me a 10 months long case ....)

@MHM Cisco World

the weird thing here is that repeat counters are present in live logs 

the issue is about the way they are (not) sorted in the report.

Another think I note is that , with the very same endpoint set, repeat counters are far less in 3.2 then I was used to see in 2.4.

Regards 

M

[MHM Cisco World]

Did you check config I share in both patch?

Compare the config 

MHM

[marco.merlo]

Yes , I think they are default values .

I'll wait for patch 6 and see.

Thanks

M

[Marvin Rhoads]

As a point of comparison, I just checked a 3.1 p7 deployment and it also sorts repeats from highest to lowest.