ISE troubleshooting help

[jaime.pedraza]

In various deployments I have facing an annoying behavior when many test are done with the same error. A coffee or going to lunch has solved the extrange results of some tests. I guess that ISE temporary "blocks" the user/device to continue doing connection attempts. Does anyone knows is there any way to see if this is true and where to "reset" this status?

Does anyone know if there is a way to see an step by step evaluation result of each condition  inside the authorization rules? It is possible to see, for example, the problem of a rule is the mistyping of the ssid name?

Many thanks,

James

[Seb Rupik · Accepted solution]

Hi James,

Sounds to me like the 'suppress anomalous clients' feature. Certainly disabling it helps with troubleshooting.

Find it here:

Administration -> Settings -> Protocols -> Radius

...either lower the request rejection interval to something more convenient or disable it entirely.

cheers,

Seb.

[jaime.pedraza]

Seb many thanks for your response. It looks very promising!! I will test it and let you know. Any idea how to see the match or not match of the internal requirements on the authorization rules?

Regards,

James

[Seb Rupik]

Hi James,

Take a look under Operations -> Authentications

...each line item has a detail button. In the window that pops up the right-hand pane will have a sequential list of the authtentication and authorization process. You should see a line which tells you what matched...probably the default deny, eg:

15006     Matched Default Rule
15013     Selected Identity Source - DenyAccess
22017     Selected Identity Source is DenyAccess

Failing that you could take a look under Administration -> System -> Logging , find the 'category name' (probably 'Failed Attempts'), set to debug and collect the logs. Make sure you revert the debug setting once you've finished.

cheers,

Seb.

[jaime.pedraza]

Hello Seb,

Disabling anomalous clients supression worked perfectly. It should be a "good practice" mentioned by Cisco. 

On the other hand, it is possible to see the matching rule indeed, but what about the conditions inside this rule? It could be easy to find the non-matching conditions about identity looking at the details you commented on the live authentication page, but other network services or flow conditions have not been easy to find why are not matching. 

Many thanks,

James