topic Re: Custom NMAP scans failing due to bad syntax from ISE in Network Access Control

Custom NMAP scans failing due to bad syntax from ISE

DGibson175 — Mon, 10 Aug 2020 18:28:57 GMT

Hi,

I've been trying to configure some custom NMAP scans for device profiling. From looking at some debug output, it looks as though the nmap command (created by ISE, and passed to the NMAP process) has an incorrect syntax, so NMAP quits without executing the scan. I simply want to scan 5 UDP ports on a speaker, but no scan traffic makes it to the speaker - or even leaves the interface on the ISE appliance.

We have tried on 2.6 patch 2, 3, 5, and 7. So far no luck.

Here is the log output, any help is appreciated!

2020-08-06 11:01:05,163 WARN [SubnetScanner][] cisco.profiler.probes.nmap.NmapCmdExecuter -::- Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-"

2020-08-06 11:01:05,163 WARN [SubnetScanner][] cisco.profiler.probes.nmap.NmapCmdExecuter -::- QUITTING!

Re: Custom NMAP scans failing due to bad syntax from ISE

Colby LeMaire — Mon, 10 Aug 2020 22:52:36 GMT

Can you post a screenshot of your custom NMAP scan action and its settings?

Re: Custom NMAP scans failing due to bad syntax from ISE

DGibson175 — Fri, 04 Sep 2020 18:08:52 GMT

Hi, sorry for the late reply, I didn't see a notification that somebody had answered.

So just an update, we opened a TAC case, and Cisco has acknowledged that it is a bug. A new bug ID was created to track the issue.

Thanks,