topic Cisco ISE 2.3/2.4 Referential integrity errors in Network Access Control

Cisco ISE 2.3/2.4 Referential integrity errors

Eric R. Jones — Mon, 30 Jul 2018 04:33:29 GMT

Hello, I have a Device Group that I no longer need created under Work Centers > Network Resources >Device Groups. When I try to remove it I get an error "One of the groups cannot be deleted. Referential Integrity error: This item is referred to by another object." .

I first removed the 4 items in the Network Devices section and tried again but it failed.

Anyone know what other object(s) could be using this group?

Googled around but most everyone else had this issue related to Active Directory changes.

Re: Cisco ISE 2.3/2.4 Referential integrity errors

Arne Bier — Mon, 30 Jul 2018 05:34:51 GMT

Hi Eric

have you looked through all of your Radius and TACACS Policy Sets? NDG is heavily used there and you may have (inadvertently) made reference to your old NDG's.

Having said that - I feel your pain with that error. It's a long standing problem and something that could/should be fixed by the BU. How hard can it be to include the actual reference ???

Re: Cisco ISE 2.3/2.4 Referential integrity errors

Eric R. Jones — Wed, 01 Aug 2018 00:49:53 GMT

The Radius and TACACS policy sets don't show any reference to the value I'm trying to remove from the Device Groups section. What I did discover is that I can select that in the "Network Device Group" window there is All Groups > Choose Group with a drop down.

If I hover over that I may select the Device Group I wish to remove, select the check box of that group and choose "Show group members".

From there I can see all the members of that group, select one or all and then choose to move the devices to another group; however, no other group is displayed.

Re: Cisco ISE 2.3/2.4 Referential integrity errors

hslai — Wed, 01 Aug 2018 04:37:50 GMT

Please open a TAC case, if not already done, and provide a copy of the current CFG backup so that TAC may help cleaning it up from the database.