topic Re: ISE 2.2 + Base License + EST & CA Services are down? in Network Access Control

ISE 2.2 + Base License + EST & CA Services are down?

musultan — Sun, 05 Nov 2017 22:12:37 GMT

Hello Experts,

Why do we need to have the CA service and EST Service running when ISE 2.2 is only have the Base license?

If yes, than why do we need them to be enabled?

It is disabled on PAN but both are "running" on SAN.

We just upgraded it from ISE 1.4 to ISE 2.2-P4.

Please explain it in detail.

Re: ISE 2.2 + Base License + EST & CA Services are down?

hslai — Mon, 06 Nov 2017 01:40:56 GMT

This looks the same as the recent filed CSCvg51862

Re: ISE 2.2 + Base License + EST & CA Services are down?

musultan — Mon, 06 Nov 2017 05:57:08 GMT

Thanks for the reply hslai.

Still, i have a question related to these services can be run if we have only BASE license or how is this related?

EST must be running when CA service is running.

In my Cx PAN, EST service got run after replacing the ISE Root Certs but CA service was still down.

Did you see it somewhere? and how is it possible?

Kindly explain it a bit.

Re: ISE 2.2 + Base License + EST & CA Services are down?

hslai — Mon, 06 Nov 2017 17:09:16 GMT

ISE internal CA can also be used by the pxGrid subscribers of Cisco products for PassiveID so it needs to be available for BASE.

As the CA services remained down after replacing ISE root certificates for ISE internal CA, I would suggest a TAC recreate and, if needed, open an ISE ESC case.