topic Re: Unable to set sftp in ISE 2.3 in Network Access Control

Unable to set sftp in ISE 2.3

rohitbhanu009 — Fri, 21 Feb 2020 18:47:19 GMT

HI,

we are using ISE 2.3 and try to set SFTP into this and getting below error message

****************************************************************

Error messages

ISE-Test/master# show repository ragnar-sftp
% Failure occurred during request

**************************************************************

Version

ISE-Test/master# show version

Cisco Application Deployment Engine OS Release: 3.0
ADE-OS Build Version: 3.0.3.030
ADE-OS System Architecture: x86_64

Version information of installed applications
---------------------------------------------

Cisco Identity Services Engine
---------------------------------------------
Version : 2.3.0.298
Build Date : Tue Jul 25 19:02:37 2017
Install Date : Tue Jan 2 13:14:02 2018

*************************************************************

Debug error messages

ISE-Test/master# 7 [32510]:[debug] backup-restore:history: br_cli.c[359] [master]: _cars_show_repository INVOKED
7 [32510]:[debug] locks:file: lock.c[384] [master]: obtained repos-mgr lock
7 [32510]:[debug] config:repository: rm_repos_cfg.c[131] [master]: loaded repository ragnar-sftp
7 [32510]:[debug] locks:file: lock.c[390] [master]: INVOKED: releasing repos-mgr lock
7 [32510]:[debug] locks:file: lock.c[419] [master]: released repos-mgr lock
6 [32510]:[info] transfer: cars_xfer.c[224] [master]: sftp dir of repository ragnar-sftp requested
7 [32510]:[debug] config:repository: rm_repos_cfg.c[481] [master]: parsed protocol - sftp
7 [32510]:[debug] config:repository: rm_repos_cfg.c[498] [master]: parsing server & path: 10.107.0.116/ISE/
7 [32510]:[debug] config:repository: rm_repos_cfg.c[514] [master]: parsed server - 10.107.0.116
7 [32510]:[debug] config:repository: rm_repos_cfg.c[532] [master]: parsed protocol: sftp, server: 10.107.0.116, path: ISE/, file:
6 [32510]:[info] transfer: cars_xfer_util.c[2298] [master]: resolved server to 10.107.0.116
7 [32510]:[debug] transfer: sftp_handler.c[945] [master]: Running sftp command: 10.107.0.116 ISE *** /ISE/ ls -l /ISE/
6 [32510]:[info] transfer: sftp_handler.c[474] [master]: DEBUG: local user: master UID: 0 sftp_run_parent FD: 5 remote host: 10.107.0.116 remote user: ISE command: ls -l /ISE/
7 [32512]:[debug] transfer: sftp_handler.c[198] [master]: Executing SFTP command: 0 master /usr/bin/sftp -oIdentityFile=/home/master/.ssh/id_rsa -oUserKnownHostsFile=/home/master/.ssh/known_hosts ISE@10.107.0.116
3 [32510]:[error] transfer: sftp_handler.c[755] [master]: sftp_run_parent Error: unable to handle sftp output
7 [32510]:[debug] transfer: sftp_handler.c[835] [master]: sftp parent status -999
6 [32510]:[info] backup-restore:history: br_cli.c[371] [master]: error message: Failure occurred during request
7 [32541]:[debug] backup-restore:history: br_cli.c[359] [master]: _cars_show_repository INVOKED
7 [32541]:[debug] locks:file: lock.c[384] [master]: obtained repos-mgr lock
7 [32541]:[debug] config:repository: rm_repos_cfg.c[131] [master]: loaded repository ragnar-sftp
7 [32541]:[debug] locks:file: lock.c[390] [master]: INVOKED: releasing repos-mgr lock
7 [32541]:[debug] locks:file: lock.c[419] [master]: released repos-mgr lock
6 [32541]:[info] transfer: cars_xfer.c[224] [master]: sftp dir of repository ragnar-sftp requested
7 [32541]:[debug] config:repository: rm_repos_cfg.c[481] [master]: parsed protocol - sftp
7 [32541]:[debug] config:repository: rm_repos_cfg.c[498] [master]: parsing server & path: 10.107.0.116/ISE/
7 [32541]:[debug] config:repository: rm_repos_cfg.c[514] [master]: parsed server - 10.107.0.116
7 [32541]:[debug] config:repository: rm_repos_cfg.c[532] [master]: parsed protocol: sftp, server: 10.107.0.116, path: ISE/, file:
6 [32541]:[info] transfer: cars_xfer_util.c[2298] [master]: resolved server to 10.107.0.116
7 [32541]:[debug] transfer: sftp_handler.c[945] [master]: Running sftp command: 10.107.0.116 ISE *** /ISE/ ls -l /ISE/
6 [32541]:[info] transfer: sftp_handler.c[474] [master]: DEBUG: local user: master UID: 0 sftp_run_parent FD: 5 remote host: 10.107.0.116 remote user: ISE command: ls -l /ISE/
7 [32543]:[debug] transfer: sftp_handler.c[198] [master]: Executing SFTP command: 0 master /usr/bin/sftp -oIdentityFile=/home/master/.ssh/id_rsa -oUserKnownHostsFile=/home/master/.ssh/known_hosts ISE@10.107.0.116
3 [32541]:[error] transfer: sftp_handler.c[755] [master]: sftp_run_parent Error: unable to handle sftp output
7 [32541]:[debug] transfer: sftp_handler.c[835] [master]: sftp parent status -999
6 [32541]:[info] backup-restore:history: br_cli.c[371] [master]: error message: Failure occurred during request
^C
ISE-Test/master# 7 [14694]:[debug] cdp:infra: ether-write.c[87] [system]: WriteEther(): wrote len: 171
7 [14694]:[debug] cdp:infra: ether-write.c[119] [system]: cdpd write succeeded for eth0
7 [14694]:[debug] cdp:infra: main.c[126] [system]:
Writing with retransmission time 60...
7 [14694]:[debug] cdp:infra: ether-write.c[87] [system]: WriteEther(): wrote len: 171
7 [14694]:[debug] cdp:infra: ether-write.c[119] [system]: cdpd write succeeded for eth0
7 [14694]:[debug] cdp:infra: main.c[126] [system]:
Writing with retransmission time 60...

Re: Unable to set sftp in ISE 2.3

Mark Elsen — Mon, 05 Mar 2018 14:27:46 GMT

- Check your sftp server's logs too, look for errors if any.

Re: Unable to set sftp in ISE 2.3

rohitbhanu009 — Mon, 05 Mar 2018 15:00:01 GMT

In SFTP server we can see user authentication is successful. Please see the attached file for same.

Thanks

Rohit

Re: Unable to set sftp in ISE 2.3

Mark Elsen — Mon, 05 Mar 2018 15:12:17 GMT

- Check the thread below and look for the string 'Solarwinds server config' ; in this context it would be 'interesting' to for instance 1) delete the repository and create it again. Check wether the problem persists 2) Try if possible, as a test, using another SFTP server, on another platform. Check wether you will then experience the same issues.

https://supportforums.cisco.com/t5/aaa-identity-and-nac/cisco-ise-backup-failing/td-p/2212266

Re: Unable to set sftp in ISE 2.3

rohitbhanu009 — Mon, 05 Mar 2018 16:18:50 GMT

I followed below option as mentioned in the link but still same issue

ISE-Test/master(config)# no repository ragnar-sftp
ISE-Test/master(config)#
ISE-Test/master(config)#
ISE-Test/master(config)# repository ragnar-sftp
ISE-Test/master(config-Repository)# url sftp://10.107.0.116/ISE/
% Warning: Repositories configured from CLI cannot be used from the ISE web UI and are not replicated to other ISE nodes. If this repository is not created in the ISE web UI, it will be deleted when ISE services restart.
ISE-Test/master(config-Repository)# user ?
<WORD> Username for repository access (Max Size - 30)

ISE-Test/master(config-Repository)# user exkrsh password
hash plain
ISE-Test/master(config-Repository)# user exkrsh password plain Rohit1234
ISE-Test/master(config-Repository)#
ISE-Test/master(config-Repository)#
ISE-Test/master(config-Repository)#
% Warning: Host key of the server must be added using 'crypto host_key add' exec command before sftp repository can be used.

ISE-Test/master# crypto host_key add host 10.107.0.116
host key fingerprint added
# Host 10.107.0.116 found: line 1
10.107.0.116 RSA SHA256:zpzKbESbDowA2VliK1SadomGcJWDDttTNrbUXq+vh7Y
ISE-Test/master# show repository ragnar-sftp
% Failure occurred during request

Re: Unable to set sftp in ISE 2.3

Mark Elsen — Mon, 05 Mar 2018 18:11:13 GMT

- Also issue show logging system ade/ADE.log tail ; after you issue the show repository,,, command; for the time being I can only presume 'incompatibilities' between ISE and the solarwinds SFTP server. In that context you should also check which version it is using (the SFTP server , I mean). Check for more recent versions, if any. Also and as stated you should possible check your problem versus a Linux based sftp server. Check wether the problem is then repeatable.