topic Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause in Network Access Control

Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause=

adamscottmaster2013 — Mon, 13 Jun 2022 20:39:18 GMT

I have a pair of ISE 3.1 patch-3 running as:

node1: Primary Admin; Primary MNT; PSN

node2: Secondary Admin; Secondary MNT; PSN

Everything is working fine until as security audit, the security team uses Qualys to scan these ISE devices. During the scan, I got the following these messages:

Queue Link Error: Message=From node2 To node1; Cause={tls_alert;{unknown_ca;"tls Client: In State Certify At Ssl_handshake.erl:1887 Generated Client Alert: Fatal - Unknown Ca\n"}

Queue Link Error: Message=From node1 To node2; Cause={tls_alert;{unknown_ca;"tls Client: In State Certify At Ssl_handshake.erl:1887 Generated Client Alert: Fatal - Unknown Ca\n"}

During the Qualys scan, both the radius & tacacs logs came up empty, and the system is very slow responding.

Is that expected? I thought SNS-3615 should be able to handle Qualys scan. Thoughts?

Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause

ahollifield — Wed, 15 Jun 2022 15:16:00 GMT

This has nothing to do with the Qualys scan. This is the ISE messaging certificate. You need to re-generate the ISE root CA and then re-generate the ISE messaging service certificate for all nodes.

Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause

adamscottmaster2013 — Thu, 16 Jun 2022 13:52:26 GMT

I resolved the issue by blocking Qualys from scanning this ISE and haven't seen this issue for the past few days.

Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause

Mark Elsen — Thu, 16 Jun 2022 16:35:38 GMT

- FYI : https://community.cisco.com/t5/security-documents/ise-queue-link-error/ta-p/4625179

Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause

Marcelo Morais — Fri, 17 Jun 2022 06:50:00 GMT

Hi @adamscottmaster2013 ,

interesting ... could you please double check your Qualys configuration via the ThreatCentric NAC with Qualys and ISE.?

Regards

Re: Queue Link Error: Message=From Primary_ISE To Secondary_ISE; Cause

adamscottmaster2013 — Fri, 17 Jun 2022 15:08:03 GMT

@Mark Elsen: As I've said before, I blocked qualys from scanning the ISE appliances and have not seen queue-link error since.