topic Re: Traffic on port TCP/9399 between primary and secondary administrative nodes in Network Access Control

Traffic on port TCP/9399 between primary and secondary administrative nodes

giosif — Mon, 21 May 2018 15:25:22 GMT

Hi,

Working with a customer ISE deployment (version 2.2 patch 7) and we are seeing traffic between the PAN and the SAN on port TCP/9399.

Q1: Can someone please tell me what that port is used for?

The closest thing I could find the documentation was TCP/9300 for Elastic Search, but that's a bit far off from what we are seeing.

Q2: Is the use of this port intentional?

If so, we need to include it in our documentation.

If not, then I guess this is a bug?

Also, in case anyone asks, I can confirm the source port for this traffic was an ephemeral one (i.e. different from one connection to another, with a random value and above 1024).

Re: Traffic on port TCP/9399 between primary and secondary administrative nodes

hslai — Mon, 21 May 2018 17:11:46 GMT

I am not aware any ISE services using it.

Please use ISE admin CLI "show tech" and look for "netstat -tunap...", which will give us an idea which program name is using it. Below is a sample output:

*****************************************

Running netstat -tunap...

*****************************************

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 28529/redis-server

tcp 0 0 127.0.0.1:31755 0.0.0.0:* LISTEN 28319/timestensubd

tcp 0 0 127.0.0.1:25550 0.0.0.0:* LISTEN 28324/ttcserver

Re: Traffic on port TCP/9399 between primary and secondary administrative nodes

giosif — Mon, 21 May 2018 17:20:22 GMT

Thanks for the response!

I will see if I can get that information, but it seems to have coincided with the moment we were re-building the Elastic Search DB (as per the notes for CSCvh48558, in a distributed deployment with PAN and SAN).

Regards,

George

Re: Traffic on port TCP/9399 between primary and secondary administrative nodes

giosif — Tue, 22 May 2018 09:38:23 GMT

Ok, I was able to replicate this in the lab, by doing an Context Visibility reset between a PAN and a SAN (i.e. "application configure ise" -> option 19):

The below logs are from the SAN:

logs/ise-elasticsearch.log:[2018-05-22 07:32:44,987][INFO ][transport ] [testice02] publish_address {testice02.<<EDITED>>/172.20.10.21:9399}, bound_addresses {172.20.10.21:9399} logs/ise-elasticsearch.log:[2018-05-22 07:32:49,567][INFO ][cluster.service ] [testice02] new_master {testice02}{eWJ8Xpa1TQClTWZmqTfxIg}{172.20.10.21}{testice02.<<EDITED>>/172.20.10.21:9399}, reason: zen-disco-join(elected_as_master, [0] joins received) logs/ise-elasticsearch.log:[2018-05-22 07:33:46,552][WARN ][discovery.zen.ping.unicast] [testice02] [1] failed send ping to {#zen_unicast_1#}{172.20.10.20}{testice01.<<EDITED>>/172.20.10.20:9399}

In the meantime, I was also able to confirm with someone from the BU that this is a new port being used.

It just needs to be added to the documentation.