ISE Smart Licensing via http proxy - deeper dive

Arne Bier — Thu, 30 Nov 2017 01:50:53 GMT

Smart Licensing is cool and we're busy converting all of our traditional licenses to Smart. We're also using Smart on Cisco Prime.

The challenge I am having is that in my environment, all internet traffic needs to go via an internal Proxy. The preferred scenario is that the proxy is authenticated (username/password). ISE supports this because I can configure a proxy with user credentials. I have tested this and I was able to use it for my SMS gateway feature which lives on the internet.

But the proxy doesn't work with Smart Licensing. I have taken countless tcpdumps and eventually logged a TAC case. There is a bug CSCvd93008 related to this.

As a workaround my customer said that they would whitelist the ISE PAN(s) to allow unauthenticated access through the proxy. But when we tried to allow tools.cisco.com the Smart Licensing didn't work.

Question: What is the FULL URL that ISE tries to access when talking to Cisco for Smart Licensing?

I don't know http and https that well, but I think a client will build a TLS connection to tools.cisco.com first, and only once the TLS tunnel is established it will try to POST/GET/whatever to the final URL. And if that's the case, we cannot see that in a tcpdump because the session is encrypted. Maybe that's why the URL filter won't work.

So what then should the proxy whitelisting URL contain? Is it even possible, or can one only whitelist the FQDN?

#life_is_easy_without_proxies_getting_in_the_way

Re: ISE Smart Licensing via http proxy - deeper dive

kthiruve — Fri, 01 Dec 2017 03:36:40 GMT

Arne,

Not sure what version of ISE is this. Couple of things, I think the URL is hardcorded and since it is https, you cannot see via Wireshark captures. I have reached out to Engineering on the defect. Will update you more once I find.

Thanks

Krishnan

Re: ISE Smart Licensing via http proxy - deeper dive

Arne Bier — Sun, 03 Dec 2017 22:56:09 GMT

Hi this is ISE 2.3 patch 1.

Re: ISE Smart Licensing via http proxy - deeper dive

hslai — Tue, 05 Dec 2017 03:04:24 GMT

I see your TAC case is making progress and you already have the correct URL for the Smart Licensing site. Please continue working with TAC. I will write to TAC with my comments.

topic Re: ISE Smart Licensing via http proxy - deeper dive in Network Access Control

ISE Smart Licensing via http proxy - deeper dive

Re: ISE Smart Licensing via http proxy - deeper dive

Re: ISE Smart Licensing via http proxy - deeper dive

Re: ISE Smart Licensing via http proxy - deeper dive