topic Re: pxGrid - 503 Service unavailable in Network Access Control

pxGrid - 503 Service unavailable

Antonio Macia — Wed, 22 Jun 2022 15:48:38 GMT

Hi,

I'm trying to create an account for the integration in pxGrid of the Palo Alto's TrustSec plug-in but I'm getting an error saying that the service is not available. This is the first pxGrid client I'm registering in ISE. I run a diagnostic test but it doesn't return any error. How can I debug this?

Regards.

Re: pxGrid - 503 Service unavailable

balaji.bandi — Wed, 22 Jun 2022 15:57:53 GMT

what is the version of ISE, pxgrid enabled on ISE side ?

can you post output :

# show application status ise

you can check the logs :

show logging application pxgrid/pxgrid-XXXX.log

Re: pxGrid - 503 Service unavailable

Antonio Macia — Thu, 23 Jun 2022 09:10:32 GMT

Hi Balaji,

Here is the output. pxGrid service is enabled on the PSN node but I don't see any reference of it on the command below apart for the pxGrid cloud agent which is actually not enabled because we don't need it.

ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 10434
Database Server running 140 PROCESSES
Application Server running 25530
Profiler Database running 17466
ISE Indexing Engine running 27004
AD Connector running 29840
M&T Session Database running 17245
M&T Log Processor running 25772
Certificate Authority Service running 28733
EST Service running 67115
SXP Engine Service running 29608
TC-NAC Service disabled
PassiveID WMI Service disabled
PassiveID Syslog Service disabled
PassiveID API Service disabled
PassiveID Agent Service disabled
PassiveID Endpoint Service disabled
PassiveID SPAN Service disabled
DHCP Server (dhcpd) disabled
DNS Server (named) disabled
ISE Messaging Service running 13477
ISE API Gateway Database Service running 15976
ISE API Gateway Service running 21971
Segmentation Policy Service disabled
REST Auth Service disabled
SSE Connector disabled
Hermes (pxGrid Cloud Agent) disabled

Regarding the log file, how can I list a log file in particular?

ise/admin# show logging application ?
<WORD> Application log file name (Max Size - 255)
> Output Redirection.
| Output modifiers.
<cr> Carriage return.

ise/admin# show logging application pxgrid
cat: /opt/CSCOcpm/logs/pxgrid: Is a directory
% Error: ise Application log output generated Errors

ise/admin# show logging application pxgrid tail
tail: error reading '/opt/CSCOcpm/logs/pxgrid': Is a directory
tail: /opt/CSCOcpm/logs/pxgrid: cannot follow end of this type of file; giving up on this name
tail: no files remaining
% Error: <A0>V<A1>><A0>U Application log output generated Errors

Regards.

Re: pxGrid - 503 Service unavailable

balaji.bandi — Thu, 23 Jun 2022 10:17:53 GMT

I am missing something here - You have PX Grid enabled ( what ISE version ?)

click >Administration >System >Deployment > node_name ( General Settings)

Re: pxGrid - 503 Service unavailable

Antonio Macia — Thu, 23 Jun 2022 10:21:37 GMT

Running ISE 3.1.

Re: pxGrid - 503 Service unavailable

Antonio Macia — Thu, 23 Jun 2022 10:35:41 GMT

Didn't mention it but at the moment I'm running in evaluation mode. Don't think it makes any difference....

Re: pxGrid - 503 Service unavailable

balaji.bandi — Thu, 23 Jun 2022 11:09:11 GMT

evaluation should work too. Do you have any Firewall between ?

Try below :

curl -k https://PXGRDI:8910/pxgrid/control/version

Re: pxGrid - 503 Service unavailable

Antonio Macia — Thu, 23 Jun 2022 12:54:03 GMT

No firewall.

Running the command returns "2.0"

That might be the issue. The Palo Alto plug-in is compatible with version 1.0 only....

Re: pxGrid - 503 Service unavailable

balaji.bandi — Thu, 23 Jun 2022 13:26:45 GMT

Check the compatability then.

Re: pxGrid - 503 Service unavailable

Charlie Moreton — Thu, 23 Jun 2022 13:28:41 GMT

You are correct, ISE 3.1 uses pxGrid 2.0 and does not use pxGrid 1.0, that functionality has been dropped. It's there in ISE 3.0, so if this is a feature you NEED, you can wait for Palo Alto to update or you can downgrade ISE.

Re: pxGrid - 503 Service unavailable

jworley79 — Mon, 05 Feb 2024 02:54:07 GMT

I ran into this 503 error. It was because I didn't have password-based account creation enabled for pxgrid.

Once I enabled it, no more 503 errors and success.