Time

Shows the time that the log was received by the monitoring and troubleshooting collection agent. This column is required and cannot be deselected.

Status

Shows if the authentication was successful or a failure. This column is required and cannot be deselected. Green is used to represent passed authentications. Red is used to represent failed authentications.

Details

Brings up a report when you click the magnifying glass icon, allowing you to drill down and view more detailed information on the selected authentication scenario. This column is required and cannot be deselected.

Repeat Counter

Shows the number of time the authentication requests were repeated in last 24 hours, without any change in the context of identity, network devices, and authorization

Reset Repeat Counts

Click to reset the Retry options for all the endpoints

Identity

Shows the username that is associated with the authentication.

Endpoint ID

Shows the unique identifier for an endpoint, usually a MAC or IP address.

Endpoint Profile

Shows the type of endpoint that is profiled, for example, profiled to be an iPhone, Android, MacBook, Xbox, and so on.

Authentication Policy

Shows the name of the policy selected for specific authentication.

IP Address

Shows the IP address of the endpoint device.

Network Device

Shows the IP address of the Network Access Device.

Device Port

Shows the port number at which the endpoint is connected.

Authorization Profiles

Shows an authorization profile that was used for authentication.

Identity Group

Shows the identity group that is assigned to the user or endpoint, for which the log was generated.

Posture Status

Shows the status of posture validation and details on the authentication.

Event

Shows the event status.

Failure Reason

Shows a detailed reason for failure, if the authentication failed.

Auth Method

Shows the authentication method that is used by the RADIUS protocol, such as Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAPv2), IEE 802.1x or dot1x, and the like.

Authentication Protocol

Shows the authentication protocol used, such as Protected Extensible Authentication Protocol (PEAP), Extensible Authentication Protocol (EAP), and the like.

Security Group

Shows the group that is identified by the authentication log.

Server

Indicates the Policy Service from which the log was generated.

Session ID

Shows the session ID.

Initiated

Shows the timestamp when the authentication session was initiated.

Updated

Shows the timestamp when the session was last updated due to any change, like a CoA action.

Account Session Time

Shows the time span (in seconds) of a user's session.

Session Status

Shows the current status of the endpoint device.

CoA Action

Use this to dynamically change the authorization of an active RADIUS session or disconnect an active RADIUS session.

Repeat Count

Shows the number of times the session has been retried.

Endpoint ID

Shows the unique identifier for an endpoint, usually a MAC or IP address.

Identity

Shows the username of the endpoint device.

IP Address

Shows the IP address of the endpoint device.

Audit Session ID

Shows a unique session identifier provided by NAS.

Account Session ID

Shows a unique ID provided by NAS.

Endpoint Profile

Shows the endpoint profile for the device.

Posture Status

Shows the status of posture validation and details on the authentication.

Security Group

Shows the group that is identified by the authentication log.

Server

Indicates the Policy Service from which the log was generated.

Auth Method

Shows the authentication method that is used by the RADIUS protocol, such as Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), IEE 802.1x or dot1x, and the like.

Authentication Protocol

Shows the authentication protocol used, such as Protected Extensible Authentication Protocol (PEAP), Extensible Authentication Protocol (EAP), and the like.

NAS IP Address

Shows IP address of the network devices.

Device Port

Shows the connected port to the network device.

PRA Action

Shows the periodic reassessment action taken on a client after it is successfully postured for compliance on your network.

EPS Status ANC Status

Shows the Endpoint Protection Service Adaptive Network Controlstatus of a device as Quarantine, Unquarantine, or Shutdown.

WLC Roam

Shows the boolean (Y/N) used to track that an endpoint has been handed off during roaming, from one WLC to another. It has the value of cisco-av-pair=nas-update =Y or N.

Packets In

Shows the number of packets received.

Packets Out

Shows the number of packets sent.

Bytes In

Shows the number of bytes received.

Bytes Out

Shows the number of bytes sent.

Session Source

Shows if the endpoint was authenticated via RADIUS or Identity Mapping.

Username

Enter the username of the user whose authentication you want to troubleshoot.

MAC Address

Enter the MAC address of the device that you want to troubleshoot.

Audit Session ID

Enter the audit session ID that you want to troubleshoot.

NAS IP

Enter the NAS IP address.

NAS Port

Enter the NAS port number.

Authentication Status

Choose the status of your RADIUS authentication.

Failure Reason

Enter the failure reason or click Select to choose a failure reason from a list. Click Clear to clear the failure reason.

Time Range

Select a time range. The RADIUS authentication records that are created during this time range are used.

Start Date-Time

If you choose Custom Time Range, enter the start date and time, or click the calendar icon to select the start date and time. The date should be in the mm/dd/yyyy format and time in the hh:mm format.

End Date-Time

If you choose Custom Time Range, enter the end date and time, or click the calendar icon to select the end date and time. The date should be in the mm/dd/yyyy format and time in the hh:mm format.

Fetch Number of Records

Choose the number of records that you want to fetch from the drop-down list: 10, 20, 50, 100, 200, or 500.

Enter Information

Network Device IP

Enter the IP address of the network device on which you want to run the command.

Command

Enter the show command.

Enter Information

Network Device IP

Enter the IP address of the network device whose configuration you want to evaluate.

Select the configuration items below that you want to compare against the recommended template.

AAA

This option is selected by default.

RADIUS

This option is selected by default.

Device Discovery

This option is selected by default.

Logging

This option is selected by default.

Web Authentication

Check this check box to compare the web authentication configuration.

Profiler Configuration

Check this check box to compare the Profiler configuration.

Trustsec

Check this check box if you want to compare Trustsec configuration.

802.1X

Check this check box if you want to compare the 802.1X configuration, and choose one of the available options.

Search and Select a Posture event for troubleshooting

Username

Enter the username to filter on.

MAC Address

Enter the MAC address to filter on, using format: xx-xx-xx-xx-xx-xx

Posture Status

Select the authentication status to filter on:

Failure Reason

Enter the failure reason or click Select to choose a failure reason from a list. Click Clear to clear the failure reason.

Time Range

Select a time range. The RADIUS authentication records that are created during this time range are used.

Start Date-Time:

(Available only when you choose Custom Time Range) Enter the start date and time, or click the calendar icon to select the start date and time. The date should be in the mm/dd/yyyy format and time in the hh:mm format.

End Date-Time:

(Available only when you choose Custom Time Range) Enter the end date and time, or click the calendar icon to select the start date and time. The date should be in the mm/dd/yyyy format and time in the hh:mm format.

Fetch Number of Records

Select the number of records to display: 10, 20, 50, 100, 200, 500

Search Result

Time

Time of the event

Status

Posture status

Username

User name associated with the event

MAC Address

MAC address of the system

Failure Reason

Failure reason for the event

Status

• Stopped—the tcpdump utility is not running

• Start—Click to start the tcpdump utility monitoring the network.

• Stop—Click to stop the tcpdump utility

Host Name

Choose the name of the host to monitor from the drop-down list.

Network Interface

Choose the network interface to monitor from the drop-down list.

Promiscuous Mode

• On—Click to turn on promiscuous mode (default).

• Off—Click to turn off promiscuous mode.

Promiscuous mode is the default packet sniffing mode. It is recommended that you leave it set to On. In this mode the network interface is passing all traffic to the system’s CPU.

Filter

Enter a boolean expression on which to filter. Standard tcpdump filter expressions are supported.

Format

Select a format for the tcpdump file.

Dump File

Displays data on the last dump file, such as the following:

Last created on Wed Apr 27 20:42:38 UTC 2011 by admin

File size: 3,744 bytes
Format: Raw Packet Data
Host Name: Positron
Network Interface: GigabitEthernet 0
Promiscuous Mode: On

• Download—Click to download the most recent dump file.

• Delete—Click to delete the most recent dump file.

Peer SXP Devices

Peer IP Address

IP address of the peer SXP device.

VRF

The VRF instance of the peer device.

Peer SXP Mode

The SXP mode of the peer device; for example, whether it is a speaker or a listener.

Self SXP Mode

The SXP mode of the network device; for example, whether it is a speaker or a listener.

Connection State

The status of the connection.

Common Connection Parameters

User Common Connection Parameters

Check this check box to enable common connection parameters for all the peer SXP devices.

Username

Enter the username of the peer SXP device.

Password

Enter the password to gain access to the peer device.

Protocol

• Choose the protocol.

  Note	Telnet is the default option. If you choose SSHv2, you must ensure that SSH connections are enabled on the network device.

Port

• Enter the port number. The default port number for Telnet is 23 and SSH is 22.

Enable Password

Enter the enable password if it is different from your login password.

Same as login password

Check this check box if your enable password is the same as your login password.

Enter Information

Network Device IP

Enter the IP address of the network device.

Filter Results

Username

Enter the username of the user whose records you want to troubleshoot.

User IP Address

Enter the IP address of the user whose records you want to troubleshoot.

SGT

Enter the user SGT value.

Enter Information

Network Device IPs (comma-separated list)

Enter the network device IP addresses (whose device SGT you want to compare with an ISE-assigned device SGT) separated by commas.

Common Connection Parameters

Use Common Connection Parameters

Select this check box to use the following common connection parameters for comparison:

• Username—Enter the username of the network device.

• Password—Enter the password.

• Protocol—Choose the protocol.

  Note	Telnet is the default option. If you choose SSHv2, SSH connections must be enabled on the network device.

• Port—Enter the port number. The default port number for Telnet is 23 and SSH is 22.

Enable Password

Enter the enable password if it is different from your login password.

Same as login password

Select this check box if your enable password is the same as your login password.

Specify Connection Parameters for Network Device a.b.c.d

Username

Enter the username for logging in to the network device.

Password

Enter the password.

Protocol

Choose the protocol.

Port

Enter the port number.

Enable Password

Enter the enable password.

Same As Login Password

Check this check box if the enable password is the same as the login password.

Use Console Server

Select this check box to use the console server.

Console IP Address

(If the Use Console Server check box is selected) Enter the console IP address.

Advanced (Use if there is an “Expect timeout error” or the device has non-standard prompt strings)

Username Expect String

Enter the string that the network device uses to prompt for username; for example, Username:, Login:, and so on.

Password Expect String

Enter the string that the network device uses to prompt for password; for example, Password:.

Prompt Expect String

Enter the prompt that the network device uses. For example, #, >, and @.

Authentication Failure Expect String

Enter the string that the network device returns when there is an authentication failure; for example, Incorrect password, Login invalid, and so on.

Diagnosis and Resolution

Diagnosis

The diagnosis for the problem is listed here.

Resolution

The steps for resolution of the problem are detailed here.

Troubleshooting Summary

Summary

A step-by-step summary of troubleshooting information is provided here. You can expand any step to view further details.

Any configuration errors are indicated by red text.