topic Re: ISE PIC pxGrid disabled on version 3.1 in Network Access Control

ISE PIC pxGrid disabled on version 3.1

Chris S — Wed, 15 Sep 2021 13:48:12 GMT

Recently deployed an ISE PIC to accomidate the FMC switch from User Agents. Everything is setup (live sessions populating) so I attempted to switch FMC to the ISE PIC. Failed to connect on port 5222.

From what I'm seeing, I have to go to "Subscribers" -> "Summary" to enabled pxGrid (port 5222). If I attempt to go there, i'm greated with a message that says "PxGrid disabled - create a pxGrid persona". It offers a link to the deployment page but then I get a page error due to insufficient privileges.

Any ideas what i'm missing? There isn't much to configure with the PIC version...

Re: ISE PIC pxGrid disabled on version 3.1

Marcelo Morais — Wed, 15 Sep 2021 14:26:23 GMT

Hi @Chris S ,

please check the status of the ISE-PIC processes via:

ise/admin# show application status ise

ISE PROCESS NAME STATE PROCESS ID 
--------------------------------------------------------------------
Database Listener running 5072 
Database Server running 90 PROCESSES
Application Server running 9117 
AD Connector running 14187 
Certificate Authority Service running 9947 
M&T Session Database running 6408 
M&T Log Collector running 10166 
M&T Log Processor running 10057 
pxGrid Infrastructure Service running 22303 
pxGrid Publisher Subscriber Service running 22575 
pxGrid Connection Manager running 22516 
pxGrid Controller running 22625 
PassiveID WMI Service running 10498
PassiveID Syslog Service running 11483
PassiveID API Service running 12176
PassiveID Agent Service running 13046
PassiveID Endpoint Service running 13557
PassiveID SPAN Service running 13993

Hope this helps !!!

Re: ISE PIC pxGrid disabled on version 3.1

Chris S — Wed, 15 Sep 2021 14:35:52 GMT

Not seeing any pxgrid processes ...

ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 3955
Database Server running 88 PROCESSES
Application Server running 20497
AD Connector running 27539
Certificate Authority Service running 22998
M&T Session Database running 11834
M&T Log Processor running 20730
PassiveID WMI Service running 23716
PassiveID Syslog Service running 24385
PassiveID API Service running 25173
PassiveID Agent Service running 26028
PassiveID Endpoint Service running 26847
PassiveID SPAN Service running 27396
ISE Messaging Service running 8365
ISE API Gateway Database Service running 10723
ISE API Gateway Service running 17618
Segmentation Policy Service disabled
REST Auth Service disabled
SSE Connector disabled

Re: ISE PIC pxGrid disabled on version 3.1

Jo49201 — Tue, 12 Oct 2021 12:59:26 GMT

I'm seeing the same thing in my LAB, with an evaluation license.
I hope it's only a problem of evaluation license.

Re: ISE PIC pxGrid disabled on version 3.1

Chris S — Tue, 12 Oct 2021 13:06:29 GMT

Think is all finally solved. In the new ISE-PIC release (3.x), PXGrid is not a running process which is why it never showed up. Also (beginning with 3.x), it will not communicate on the same ports so FMC has to be upgrade to a minimum 6.7.

As for the bad URL, that is now a documented bug. From what TAC explained, the link should not exist in the PIC version - only the full ISE.

Re: ISE PIC pxGrid disabled on version 3.1

Jo49201 — Tue, 12 Oct 2021 13:16:33 GMT

OK that's what got my here.
I'm probably missing something in my FMC test deployment. Because i'm getting the following error in the test portion of the intergration.
Primary host:
[INFO]: PXGrid v2 is enabled
[INFO]: pxgrid 2.0: account activate succeeded
[ERROR]: Got exception. Host: ISE-PIC-02.homelab.local. Error: Ð¡annot connect to ISE-PIC-02.homelab.local:8910
[ERROR]: connection to ISE-PIC-02.homelab.local:8910 fails: Ð¡annot connect to ISE-PIC-02.homelab.local:8910
[INFO]: pxgrid 2.0: ISE server reports com.cisco.ise.config.profiler is unsupported or disabled.
[INFO]: pxgrid 2.0: ISE server reports com.cisco.ise.config.trustsec is unsupported or disabled.
[INFO]: pxgrid 2.0: ISE server reports com.cisco.ise.config.anc is unsupported or disabled.
[INFO]: These ISE Services are disabled, or are unsupported by ISE: EndpointProfile, SecurityGroups, AdaptiveNetworkControl
[INFO]: These ISE Services features not enabled on FMC: SXP
[ERROR]: These ISE Services are down: SessionDirectory
[ERROR]: Because these ISE Servers are offline: ISE-PIC-02.homelab.local

Thank you for the response, Chris.

Re: ISE PIC pxGrid disabled on version 3.1

Catalin_M — Thu, 28 Jul 2022 14:48:49 GMT

Hitting defect CSCvz72069. Fixed in 3.1 patch 1.