topic Re: ISE 2.2 - Creating custom Network Device Profile in Network Access Control

ISE 2.2 - Creating custom Network Device Profile

sean.tucceri1 — Fri, 31 Mar 2017 15:35:37 GMT

Hi All

I'm trying to create a custom network device profile on a newly built ISE 2.2 system in my dev environment. Below are the steps I follow and the error message generated.

ADD Custom NETWORK DEVICE PROFILES
1. Log into Web GUI of Primary Admin node.
2. Navigate to Administration > Network Resources > Network Device Profiles
3. Click +Add to add a new NetworkDevice Profile
a. Name: Lantronix
b. Description: Custom profile for Lantronix
c. Vendor: Other
d. Supported Protocols: TACACS+
4. Click Save button

Error message: Fail to receive server response due to the network error(ex. HTTP timeout). Please try again. Error: No such interface supported

This is the exact same way I do it for my production ISE 2.0 system but no error is generated.

Is anyone else having this issue?

Regards

Re: ISE 2.2 - Creating custom Network Device Profile

hslai — Fri, 31 Mar 2017 17:46:40 GMT

Please check the DEBUG log file "ise-psc.log" on the primary ISE node in your lab and see whether it has a line while you testing it, similar to:

2017-03-31 17:44:32,302 ERROR  [admin-http-pool49][] cpm.admin.restui.websec.PatternBasedAnalyzer -:admin:::- Value was found harmful by the pattern:com.cisco.cpm.admin.restui.websec.InsecurePattern:[dollarSign] pattern:(.*)\$(.*) action:Escape  value:${URL}     parameter name:dpt.redirtempdynavp.value exclusionTag:DptLPInputAction

I followed your steps but I got a different error. Actually, I am getting another different error when I retried. I will check with our teams to see whether it a known issue.

Re: ISE 2.2 - Creating custom Network Device Profile

sean.tucceri1 — Fri, 31 Mar 2017 18:59:10 GMT

Hi there,

Unfortunately when I checked the DEBUG log file "ise-psc.log" on my Primary ISE node (I actually only have one node with all personas on it in dev environment) I'm not seeing the same message. The only error message I see is below.

2017-03-31 00:14:13,366 ERROR [Thread-68][] cisco.cpm.admin.license.LicensePoller -::::- Error in loading properties file for enforcement tool

thanks

Re: ISE 2.2 - Creating custom Network Device Profile

hslai — Fri, 31 Mar 2017 21:07:36 GMT

Anything special with the interface(s) used by your lab ISE? Are you using bounded interface(s)?

The LicensePoller error is harmless.

Try importing the XML file inside the attached zip. You may alter the name attribute, either before or after the import, if it succeeds. I managed to get this XML by importing from Brocade_Wired2 , updating the properties in ISE, and then exporting it out.

Since I am unable to reproduce the same error, please consider open a TAC case to troubleshoot further.

Re: ISE 2.2 - Creating custom Network Device Profile

hslai — Sat, 01 Apr 2017 23:52:48 GMT

Which web browser and O/S info, including the version numbers, are you using? Any AdBlocker add-on?

I got errors with Windows 7 SP1 and Firefox ESR 38.2.1 or IE 11 whereas Chrome Version 49.0.2623.112 m (64-bit) and FF ESR 52.0.2 (32-bit/64-bit) working fine.

Also, try getting the detailed info at the web console (e.g. Firefox Browser Console) at the time of the error.

00:08:10.348 TypeError: breadcrumbGen is undefined

Stack trace:

cpm.dpt.DptEdit.submitForm/<.load@/admin/pages/modules/Dpt/DptEdit.js?_isever=149041312770361:547:25

dojo._ioSetArgs/<@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:79015

._fire/_f4@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:27914

._fire@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:28197

._resback@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:26962

.callback@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:27154

a/dojo.io.iframe.send/<@https://ise-1.demo.local/admin/ng/main.js?_isever=149041312770361:1479:272775

_254/func@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:80507

_254@https://ise-1.demo.local/admin/lib/dojo/dojo.js?_isever=149041312770361:16:80791

DptEdit.js:571:8

00:08:10.349 Object { args: Object, url: "DptLPInputAction.do?command=create&…", query: "crudOperation=add&dptToEdit=&dpt.id…", handleAs: "json", _callNext: a/dojo.io.iframe.send/t.ioArgs._callNext(), _contentToClean: Array[0], _originalTarget: null, _finished: true, _calledNext: true } DptEdit.js:572:8

Re: ISE 2.2 - Creating custom Network Device Profile

sean.tucceri1 — Mon, 03 Apr 2017 18:53:30 GMT

Success!! Thanks for the browser tip!!

I am using IE 11 version 11.0.9600.18617 on ISE 2.0 patch 3 and I have no problems.

When I was using IE 11 version 11.0.9600.18617 on ISE 2.2 I get the following Error message: Fail to receive server response due to the network error(ex. HTTP timeout). Please try again. Error: No such interface supported

I stopped using Chrome a month ago when the Chrome browser started to ask me to install Flash player while logging on to my Cisco ISE 2.2 node(I don't have workstation admin privileges). But my workstation does already have Adobe Flash Player 25.0.0.127 installed.

Today when using Chrome Version 56.0.2924.76 to logon to my cisco ISE 2.2 node I just clicked on the Accept button to install Adobe Flash Player (It didn't actually install anything). I then continued with the normal process of creating a custom Network Device Profile. It worked!!!

Thanks Again.

Re: ISE 2.2 - Creating custom Network Device Profile

hslai — Tue, 04 Apr 2017 19:22:43 GMT

Thanks for confirming it. I opened a new bug to track this issue: CSCvd88492