radius response ise

[edondurguti]

Any idea why I get this even though clients are authenticated?

[Tarik Admani · Accepted solution]

Edon,

I usually see this when i am testing, if I start to do dot1x and then i unplug the port, the peap session is still active in the ISE database and then expires after 120 seconds. Usually if users are roaming even with mobility groups set, if they happen to roam from one controller to the other, you could expect this behavior if the client happens to be associating at that time.

Thanks,

Tarik Admani
*Please rate helpful posts*

[edondurguti]

Yeah I think it got intense when I rebooted the primary ISE for that CSR issue that I had where it wouldn't generate a signing request, then everybody got policed from secondary ISE and the error popped up.

Interesting though when the primary ise came up, all the new authentication were still pointing to the secondary one all untill i had to reboot the secondary aswell, it's like the PRIMARY ISE didn't kick in when it came online.

Thank you for your help.

[Tarik Admani · Accepted solution]

Keep in mind that the radius server selection is done at the NAS (WLC and switches), once they mark a radius server dead they will keep forwarding traffic until that radius server goes off line and then they flip back over. That is to be expected.

Tarik Admani
*Please rate helpful posts*

[Tarik Admani]

Hi,

here is an article that may help you understand the flow of the radius server tracking verify these settings on your wlc.

https://supportforums.cisco.com/message/3716828#3716828

Thanks,

Tarik Admani
*Please rate helpful posts*