Cisco Ise 13 User Guide

endpointstoseethesessiontraceinformationforthatendpoint.Thefollowingfigureshowsanexampleof
thesessiontraceinformationdisplayedforanendpoint.
ThedatasetusedforsearchisbasedonEndpointIDasindexes.Therefore,whenauthenticationoccurs,
itismandatorytohaveEndpointIDsfortheendpointsforthoseauthenticationstoincludetheminthe
searchresultset.
Note
Figure 41: Session Trace of an Endpoint
Youcanusetheclickabletimelineatthetoptoseemajorauthorizationtransitions.Youcanalsoexportthe...

YoucanclickontheEndpointDetailslinktoseemoreauthentication,accounting,andprofilerinformation
foraparticularendpoint.Thefollowingfigureshowsanexampleofendpointdetailsinformationdisplayed
foranendpoint.
Figure 42: Endpoint Details
Session Removal from the Directory
SessionsarecleanedfromthesessiondirectoryontheMonitoringandTroubleshootingnodeasfollows:
•Terminatedsessionsarecleaned15minutesaftertermination.
•Ifthereisauthenticationbutnoaccounting,thensuchsessionsareclearedafteronehour....

Troubleshoot Network Access Issues
Procedure
Step 1ChooseOperations>Reports>AuthenticationSummaryReport.
Step 2FilterthereportforFailureReasons.
Step 3ReviewthedataintheAuthenticationbyFailureReasonssectionofthereporttotroubleshootyournetwork
accessproblem.
AstheAuthenticationSummaryreportcollectsanddisplaysthelatestdatacorrespondingtofailed
orpassedauthentications,thecontentsofthereportappearafteradelayofafewminutes.
Note
Diagnostic Troubleshooting Tools...

Troubleshoot Unexpected RADIUS Authentication Results
Procedure
Step 1ChooseOperations>Troubleshoot>DiagnosticTools>>GeneralTools>RADIUSAuthentication
Troubleshooting.
Step 2Specifythesearchcriteriainthefieldsasneeded.
Step 3ClickSearchtodisplaytheRADIUSauthenticationsthatmatchyoursearchcriteria.
IfyouaresearchingforADrelatedauthentication,andanActiveDirectoryserverisnotconfiguredinyour
deployment,amessagesaying'ADnotconfigured'isdisplayed.
Step...

Evaluate Configuration Validator Tool
Youcanusethisdiagnostictooltoevaluatetheconfigurationofanetworkdeviceandidentifyanyconfiguration
problems.TheExpertTroubleshootercomparestheconfigurationofthedevicewiththestandardconfiguration.
Troubleshoot Network Device Configuration Issues
Procedure
Step 1ChooseOperations>Troubleshoot>DiagnosticTools>GeneralTools>EvaluateConfiguration
Validator.
Step 2EntertheNetworkDeviceIPaddressofthedevicewhoseconfigurationyouwanttoevaluate,andspecify
otherfieldsasnecessary....

TCP Dump Utility to Validate the Incoming Traffic
Thisisatooltosniffthepacket,whenyouwanttoexaminethattheexpectedpacketreallyreachedanode.
Forexample,whenthereisnoincomingauthenticationorlogindicatedinthereport,youmaysuspectthat
thereisnoincomingtrafficorthattheincomingtrafficcannotreachCiscoISE.Insuchcases,youcanrun
thistooltovalidate.
YoucanconfiguretheTCPDumpoptionsandthencollectdatafromthenetworktraffictohelpyou
troubleshootinganetworkissue....

CiscoISEdoesnotsupportframesgreaterthan1500MTU(jumboframes).Note
Save a TCP Dump File
Before You Begin
Youshouldhavesuccessfullycompletedthetask,asdescribedintheUsingTCPDumptoMonitornetwork
Trafficsection.
YoucanalsoaccessTCPdumpthroughtheCiscoISECLI.Formoreinformation,refertotheCiscoIdentity
ServicesEngineCLIReferenceGuide.
Note
Procedure
Step 1ChooseOperations>Troubleshoot>DiagnosticTools>GeneralTools>TCPDump.
Step 2ChooseaFormatfromthedrop-downlist.HumanReadableisthedefault.
Step...

DescriptionProcess Stage
ConnectstothedevicewiththeIPaddressthatyouprovided,andobtainstheaccess
controllists(ACLs)foreachsourceanddestinationSGTpair.
1
CheckstheegresspolicythatisconfiguredinCiscoISEandobtainstheACLsfor
eachsourceanddestinationSGTpair.
2
ComparestheSGACLpolicythatisobtainedfromthenetworkdevicewiththe
SGACLpolicythatisobtainedfromCiscoISE.
3
DisplaysthesourceanddestinationSGTpairifthereisamismatch.Also,displays
thematchingentriesasadditionalinformation.
4
Troubleshoot Connectivity Issues...

Device SGT Tool
FordevicesthatareenabledwiththeTrustsecsolution,eachnetworkdeviceisassignedanSGTvaluethrough
RADIUSauthentication.TheDeviceSGTdiagnostictoolconnectstothenetworkdevice(withtheIPaddress
thatyouprovide)andobtainsthenetworkdeviceSGTvalue.ItthencheckstheRADIUSauthentication
recordstodeterminetheSGTvaluethatwasassignedmostrecently.Finally,itdisplaystheDevice-SGTpairs
inatabularformat,andidentifieswhethertheSGTvaluesarethesameordifferent.
Troubleshoot Connectivity Issues in a Trustsec-Enabled...

•Debuglogs—Capturesbootstrap,applicationconfiguration,run-time,deployment,publickey
infrastructure(PKI)informationandmonitoringandreporting.
DebuglogsprovidetroubleshootinginformationforspecificCiscoISEcomponents.Toenabledebug
logs,seeChapter11,“Logging”.Ifyoudonotenablethedebuglogs,alltheinformationalmessages
(INFO)willbeincludedinthesupportbundle.Formoreinformation,seeCiscoDebugLogs,onpage
655.
•Locallogs—ContainssyslogmessagesfromthevariousprocessesthatrunonCiscoISE....