topic Re: ISE Smart Licensing problem in Network Access Control

ISE Smart Licensing problem

knnielsen — Mon, 18 Feb 2019 19:05:06 GMT

Hi,

We recently converted our ISE 2.4 patch 4 to Smart licensing. We also converted our existing licenses (Base and Plus).

It worked for approx. one week and now it has stopped communicating with Ciscos licensing system.

When I try to use the Refresh button on the licensing page, I receive the error "Smart Licensing refresh failed". The last authentication was on 9th of February.

There is not much information in the log file - except for an "Send communcation error". But when I try to ping tools.cisco.com from the CLI, it works just fine.

I am considering deregistering and then registrer with the token again, but if it fails to re-register, I am in a bit of trouble (this ISE server is in production).

Any ideas for troubleshooting?

Best regards

Kenneth

Re: ISE Smart Licensing problem

paul — Mon, 18 Feb 2019 22:35:54 GMT

I would guess you changed something on your URL filtering/firewall side that is blocking the communication. Pings won't really test the communication.

Re: ISE Smart Licensing problem

knnielsen — Tue, 19 Feb 2019 09:36:55 GMT

Hi,

I can see an established connection in our firewall, when I try to test the profiler feed.

but when i try to refresh the licensing - nothing goes to the firewall, as if it never leaves the ISE server.

There is not much error information in the log, except:

2019-02-19 09:34:06,659 ERROR [Thread-88][] cisco.nesla.agent.impl.AsyncRequestProcessor -::::- failed to send request / process response: SmartAgentMessageRenew
2019-02-19 09:34:06,659 ERROR [Thread-88][] cisco.nesla.agent.impl.AsyncRequestProcessor -::::- schedule next reg renew
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- --> received global notification. NotifyIdCertRenewFail
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- this inside globalcom.cisco.cpm.admin.license.sl.SmartAgentNotificationListener@xxxxxxxx
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- notification type: NotifyIdCertRenewFail -- failure: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- final formatted: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- fail message: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cisco.cpm.admin.license.LicenseHelper -::::- inside logging external
2019-02-19 09:34:06,660 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- ID certificate renewal failed

Best regards

Kenneth

Re: ISE Smart Licensing problem

jdargence — Tue, 02 Mar 2021 19:52:10 GMT

Did you ever figure this out? I am seeing similar problems with my deployment

Re: ISE Smart Licensing problem

Marcelo Morais — Tue, 02 Mar 2021 21:15:52 GMT

Hi @jdargence

did you try to re-register with a new Token?

Hope this helps !!!

Re: ISE Smart Licensing problem

jdargence — Tue, 02 Mar 2021 22:55:23 GMT

I did. I generated a new Token and tried to re-register, but the errors don't go away. The last authorization on my licenses is December 03 2020

Re: ISE Smart Licensing problem

Marcelo Morais — Wed, 03 Mar 2021 12:09:16 GMT

Hi @jdargence

the Last Authorization = Dec 3, 2020 is not "a problem".

Remember that:

"... If there is a change in the compliance status when synchronized with the CSSM server, the Last Authorization column of the Licenses table updates accordingly. In addition, when entitlements are no longer compliant, the number of days for which they are out of compliancy appears in the Days Out of Compliancy column..."

Please take a look at: Cisco ISE Licenses. search for Cisco ISE Smart Licensing.

Hope this helps !!!

Re: ISE Smart Licensing problem

jdargence — Thu, 04 Mar 2021 18:21:39 GMT

Finally figured out my issue. We replaced an outdated ACS with ISE, but weren't able to use the ACS IP in the new server, so we added a NAT to redirect all traffic on our firewall to ISE's new IP. Unfortunately this NAT was also interfering with NATting to the internet. Once this was resolved, ISE was able to contact the Cisco licensing servers.

Re: ISE Smart Licensing problem

thomas — Sat, 13 Mar 2021 18:30:35 GMT

Suggest calling TAC for further troubleshooting of connectivity to CSSM.