topic Re: Stealthwatch Quarantine request failed to send to ISE in Network Access Control

Stealthwatch Quarantine request failed to send to ISE

phuhd2 — Fri, 27 Apr 2018 07:52:01 GMT

I'm deploying Cisco ISE 2.3.0 and Stealthwatch 6.9. My ISE and Stealthwatch are connected via pxGrid. I can't find configuration guide for integrating Stealthwatch 6.9 and ISE 2.3. So that I followed of the " Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)" and used the External CA Server.

ISE and Stealthwatch are connected, but I can't do Quanrantine request.

Quarantine request failed to send to ISE: "Mitigation request was not sent because no active users were present on this host, or the active users came from an ISE installation not configured to this SMC"

How do I tshoot this Error?

Re: Stealthwatch Quarantine request failed to send to ISE

nir-r — Sat, 28 Apr 2018 10:25:34 GMT

I have the same issue with Stealthwatch implementation 6.9 & 6.10

No users appear on SMC and for this reason quarantine doesn't work.

According to TAC there is a bug that should be solved with upcoming 6.9/6.10 updates (6.9.5, 6.10.3)

Re: Stealthwatch Quarantine request failed to send to ISE

phuhd2 — Wed, 02 May 2018 04:03:12 GMT

Hi nir-r,

Could you please show me the Bug link about that to me get more detail?

Re: Stealthwatch Quarantine request failed to send to ISE

hslai — Sat, 05 May 2018 05:59:32 GMT

Please ensure you are following the "Testing" section (page 44 and on) of

Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGri…

First of all, the endpoint needs authenticated to ISE successfully with an active session. Then, verify the StealthWatch receives the info and shows the entry's end time as current.

Re: Stealthwatch Quarantine request failed to send to ISE

phuhd2 — Mon, 07 May 2018 02:53:54 GMT

I didn't see any documents for Cisco ISE 2.3, so I followed "Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)".

The endpoint was authenticated to ISE successfully and on client's status also "active" as the third picture above.

Re: Stealthwatch Quarantine request failed to send to ISE

hslai — Mon, 07 May 2018 03:00:14 GMT

Page 45 of Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGri… shows a "current" session. I am suspecting that yours have nothing current.

Try logging in as a different user.

Re: Stealthwatch Quarantine request failed to send to ISE

hslai — Mon, 07 May 2018 03:01:58 GMT

Additionally, please ensure you have the latest patches installed on the StealthWatch 6.9.

Re: Stealthwatch Quarantine request failed to send to ISE

phuhd2 — Mon, 07 May 2018 03:17:58 GMT

I'm using Stealthwatch 6.9.2. I have just checked the latest patches and seen that Cisco stopped release 6.9 version. Now, only 6.10.2.

Re: Stealthwatch Quarantine request failed to send to ISE

hslai — Mon, 07 May 2018 03:58:04 GMT

6.10.2 should work.

6.9.x appears available @ "Flexera/Download & License Center" and under "Archive Versions".

Back in March 2018, StealthWatch team advised me to use 6.9.3 or 6.10.1.

Re: Stealthwatch Quarantine request failed to send to ISE

phuhd2 — Mon, 07 May 2018 07:32:03 GMT

Thanks hslai, let me update the latest patches on version 6.9 and try again.