Monitoring Patterns & Workflows

# All active sessions - table format
netapi ise mnt sessions

# JSON with jq filtering
netapi ise mnt sessions --format json | \
  jq '.[] | {mac: .calling_station_id, ip: .framed_ip_address, user: .user_name, method: .auth_method}'

netapi ise mnt sessions --format json | \
  jq -r '.[].auth_method' | sort | uniq -c | sort -rn

  42 EAP-TLS
  18 MAB
   7 PEAP
   2 EAP-FAST

netapi ise mnt sessions --format json | \
  jq -r '.[].selected_authentication_policy' | sort | uniq -c | sort -rn

netapi ise mnt sessions --format json | \
  jq -r '.[].nas_ip_address' | sort | uniq -c | sort -rn

MAC="C8:5B:76:C6:59:62"

# Quick lookup
netapi ise mnt session "$MAC"

# Detailed JSON
netapi ise mnt session "$MAC" --format json | jq '.'

# Filter sessions by IP
netapi ise mnt sessions --format json | \
  jq '.[] | select(.framed_ip_address == "10.50.10.100")'

# Reauth by MAC
netapi ise mnt coa --mac "C8:5B:76:C6:59:62" --action reauth

# Reauth by IP
netapi ise mnt coa --ip "10.50.10.100" --action reauth

# Disconnect (port bounce)
netapi ise mnt coa --mac "C8:5B:76:C6:59:62" --action disconnect

# Disconnect all sessions from specific NAS
for mac in $(netapi ise mnt sessions --format json | \
  jq -r '.[] | select(.nas_ip_address == "10.50.1.10") | .calling_station_id'); do
  echo "Disconnecting $mac"
  netapi ise mnt coa --mac "$mac" --action disconnect
done

# Push updated authz (after policy change)
netapi ise mnt coa --mac "C8:5B:76:C6:59:62" --action push

# Current auth status for endpoint
netapi ise mnt auth-status "C8:5B:76:C6:59:62"

# Last 10 auth attempts
netapi ise mnt auth-logs --mac "C8:5B:76:C6:59:62" --limit 10

# JSON for analysis
netapi ise mnt auth-logs --mac "C8:5B:76:C6:59:62" --format json | \
  jq '.[] | {timestamp, passed, failure_reason}'

# List all failure reasons
netapi ise mnt failure-reasons

# Find specific code
netapi ise mnt failure-reasons --format json | \
  jq '.[] | select(.code == "24408")'

# Today's auth stats
netapi ise dc stats

# Custom query - top failures
netapi ise dc query "
  SELECT FAILURE_REASON, COUNT(*) as failures
  FROM RADIUS_AUTHENTICATIONS
  WHERE PASSED = 0 AND TIMESTAMP_TIMEZONE > SYSDATE - 1
  GROUP BY FAILURE_REASON
  ORDER BY failures DESC
  FETCH FIRST 10 ROWS ONLY
"

# Full history for endpoint
netapi ise dc auth-history "C8:5B:76:C6:59:62"

# Last 7 days
netapi ise dc query "
  SELECT TIMESTAMP_TIMEZONE, POLICY_SET_NAME, PASSED, FAILURE_REASON
  FROM RADIUS_AUTHENTICATIONS
  WHERE CALLING_STATION_ID = 'C8:5B:76:C6:59:62'
  AND TIMESTAMP_TIMEZONE > SYSDATE - 7
  ORDER BY TIMESTAMP_TIMEZONE DESC
"

netapi ise dc query "
  SELECT CALLING_STATION_ID as MAC, COUNT(*) as auth_count
  FROM RADIUS_AUTHENTICATIONS
  WHERE TIMESTAMP_TIMEZONE > SYSDATE - 1
  GROUP BY CALLING_STATION_ID
  ORDER BY auth_count DESC
  FETCH FIRST 20 ROWS ONLY
"

netapi ise dc query "
  SELECT POLICY_SET_NAME, COUNT(*) as hits
  FROM RADIUS_AUTHENTICATIONS
  WHERE TIMESTAMP_TIMEZONE > SYSDATE - 7
  GROUP BY POLICY_SET_NAME
  ORDER BY hits DESC
"

#!/bin/bash
# troubleshoot-auth.sh - Full auth troubleshoot for endpoint

MAC="$1"
if [ -z "$MAC" ]; then
  echo "Usage: $0 <MAC_ADDRESS>"
  exit 1
fi

echo "=== Current Session ==="
netapi ise mnt session "$MAC" 2>/dev/null || echo "No active session"

echo -e "\n=== Recent Auth Attempts ==="
netapi ise mnt auth-logs --mac "$MAC" --limit 5

echo -e "\n=== Endpoint Profile ==="
netapi ise get-endpoint "$MAC" --format json 2>/dev/null | \
  jq '{name, profileId, groupAssignment: .staticGroupAssignment}'

echo -e "\n=== DataConnect History (24h) ==="
netapi ise dc query "
  SELECT TO_CHAR(TIMESTAMP_TIMEZONE, 'HH24:MI') as time,
         PASSED, FAILURE_REASON
  FROM RADIUS_AUTHENTICATIONS
  WHERE CALLING_STATION_ID = '$MAC'
  AND TIMESTAMP_TIMEZONE > SYSDATE - 1
  ORDER BY TIMESTAMP_TIMEZONE DESC
  FETCH FIRST 10 ROWS ONLY
"

#!/bin/bash
# watch-failures.sh - Real-time failure monitoring

while true; do
  clear
  echo "=== ISE Auth Failures (Last 15 min) ==="
  echo "Time: $(date)"
  echo
  netapi ise dc query "
    SELECT TO_CHAR(TIMESTAMP_TIMEZONE, 'HH24:MI:SS') as time,
           CALLING_STATION_ID as MAC,
           SUBSTR(FAILURE_REASON, 1, 40) as reason
    FROM RADIUS_AUTHENTICATIONS
    WHERE PASSED = 0
    AND TIMESTAMP_TIMEZONE > SYSDATE - (15/1440)
    ORDER BY TIMESTAMP_TIMEZONE DESC
    FETCH FIRST 20 ROWS ONLY
  "
  sleep 30
done

#!/bin/bash
# policy-performance.sh - Compare policy set performance

echo "=== Policy Set Performance (24h) ==="
netapi ise dc query "
  SELECT
    POLICY_SET_NAME,
    COUNT(*) as total,
    SUM(CASE WHEN PASSED = 1 THEN 1 ELSE 0 END) as passed,
    SUM(CASE WHEN PASSED = 0 THEN 1 ELSE 0 END) as failed,
    ROUND(SUM(CASE WHEN PASSED = 1 THEN 1 ELSE 0 END) * 100.0 / COUNT(*), 1) as success_pct
  FROM RADIUS_AUTHENTICATIONS
  WHERE TIMESTAMP_TIMEZONE > SYSDATE - 1
  GROUP BY POLICY_SET_NAME
  ORDER BY total DESC
"

# Export current sessions to CSV
netapi ise mnt sessions --format json | \
  jq -r '["MAC","IP","User","Method","Policy","NAS"] as $h |
         $h, (.[] | [.calling_station_id, .framed_ip_address, .user_name,
                      .auth_method, .selected_authentication_policy, .nas_ip_address]) |
         @csv' > sessions-$(date +%Y%m%d).csv

#!/bin/bash
# Check failure rate and alert if > 5%

STATS=$(netapi ise dc stats --format json)
TOTAL=$(echo "$STATS" | jq '.total_authentications')
FAILED=$(echo "$STATS" | jq '.failed_authentications')
RATE=$(echo "scale=2; $FAILED * 100 / $TOTAL" | bc)

if (( $(echo "$RATE > 5" | bc -l) )); then
  echo "ALERT: High failure rate: ${RATE}% ($FAILED/$TOTAL)"
  # Send to alerting system
fi

#!/bin/bash
# Detect endpoints not in any group (potential rogues)

netapi ise mnt sessions --format json | \
  jq -r '.[].calling_station_id' | while read mac; do
  group=$(netapi ise get-endpoint "$mac" --format json 2>/dev/null | jq -r '.groupId // "NONE"')
  if [ "$group" == "NONE" ] || [ "$group" == "null" ]; then
    echo "ALERT: Unknown endpoint: $mac"
  fi
done