WLC 5508 Most Recent Traps Duplications

Question

Hi,
I have recently noticed that in my WLC traps  I keep finding lots of Mac addresses that have many hits on joining but it's the same MAC ADDRESS.  Example Mac addresss'08:11:96:e4:1a:60
4
Wed Mar 27 16:05:56 2013
Client with MAC address 08:11:96:e4:1a:60 has joined profile corporate
5
Wed Mar 27 16:05:45 2013
Client with MAC address 08:11:96:e4:1a:60 has joined profile corporate
7
Wed Mar 27 16:04:53 2013
Client with MAC address 08:11:96:e4:1a:60 has joined profile corporate
12
Wed Mar 27 16:02:51 2013
Client with MAC address 08:11:96:e4:1a:60 has joined profile corporate
  This has like 20 hits in the traps section and when I check my ISE this is also reflected on the authentication aspect. This is starting to occur with many different client laptops, why does it keep re-authenticatiing into the profile joined?
Is there a Time to Live TTL setting I can set so it doesn't poll so often? The users aren't doing anything this is all occuring automcatically, I think it's the WLC 5508 controller not the ISE.
Any ideas?
Any information would be great.
Cheers
Eddy

Answer 1

Hi Eddy,
I am not an ISE guy so not sure about ISE config. But I would say couldn't it be roaming that increases the hit count?
Whenever a client roams it authenticates again with the radius server. There are key caching mechanisms to bypass this process and makes roaming faster.
You may read this: https://supportforums.cisco.com/thread/2065138
Now, if for some reason the WLC sends a request to the ISE for every roaming process then that probably explains what you see
HTH
Amjad
Rating useful replies is more useful than saying "Thank you"