Had this issue for a while but did not have time to look into it. Every once in a while I’d get a live wired session when MAC to IP would not match. For example, this mac address is associated with 10.147.20.38. Considering this is retrieved from Radius Accounting Start message information should be 100% accurate.
but context data has a different mapping (most of the time the correct one). And of course, if I was to check arp for 10.147.20.38 mac address would not match live session log.
This was happening on ISE 2.1. Apparently, there is a bug CSCvc84399 that causes this issue (resolved in patch 4) but I was getting the same behavior on patch 6. From what I can tell if session entry had no IP address in the field then next event IP would be inserted corrupting live session log.
The fix is to install at least patch 4 and reset M&T database. Reset does not affect authentication but does impacts guest and sponsor portal access so keep that in mind. This process may take anywhere from 5 to 20 minutes and is executed on Primary and Secondary M&T nodes from command line interface.
ISE# application configure ise
Selection ISE configuration option
[1]Reset M&T Session Database
[2]Rebuild M&T Unusable Indexes
[3]Purge M&T Operational Data
[4]Reset M&T Database
[5]Refresh Database Statistics
<snip>
[17]Synchronize Context Visibility With Database
[18]Exit
4
You are about to reset the M&T database. Following this operation, application will be restarted.
Are you sure you want to proceed? y/n [n]: y
Stopping application
<snip>
Starting Database only
Creating ISE M&T database tables…
PL/SQL procedure successfully completed. >> Check for successful completion
Restarting application
ISE M&T Log Collector is not running
<snip>
Starting ISE Indexing Engine…
Starting ISE AD Connector…
Note: ISE Processes are initializing. Use ‘show application status ise’
CLI to verify all processes are in running state.
Look carefully at the output above. If you get any failures try option [1]Reset M&T Session Database and then option 4. If still fails it may indicate locked DB entry so reboot the node and try option 4 again.