topic Re: ISE Stealthwatch manager console Client offline in Network Access Control

ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Thu, 30 Jun 2022 20:02:35 GMT

i have a problem with the integration ISE and stealthwatch Pxgrid. The integration is fine but the final status in ISE client is (offline XMPP). Stealthwatch dont show the username only show the IP address (integration Stealthwatch with Active Directory is fine) and (integration ISE with Active Directory is fine).

It is the live log on ise

smc-150-232@xgrid.cisco.com Client offline

(SMC-150-232 is the stealthwatch manager console)

Re: ISE Stealthwatch manager console Client offline

Greg Gibbs — Thu, 30 Jun 2022 22:54:17 GMT

What version of ISE? What version of Stealthwatch?

What troubleshooting have you done?

Was this working before? If so, what changed?

See How to ask the Community for Help.

Re: ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Fri, 01 Jul 2022 01:01:31 GMT

Hi

ISE versión 2.7 patch 7, Steathwatch manager consolé 7.4.1

This is a fresh deployment, I see the problem in ISE and stealthwatch. Stealthwatch don’t show the username of Active Directory users and ISE the XMPP client is offline

How I can change the status of PXGRID XMPP client to online ?

Re: ISE Stealthwatch manager console Client offline

Greg Gibbs — Fri, 01 Jul 2022 02:46:53 GMT

SNA 7.4.1 integration with ISE 2.7 should be using pxGrid version 2 with WebSocket instead of XMPP.

If you haven't already done so, I would suggest reviewing the Secure Network Analytics (formerly Stealthwatch) ISE Configuration Guide.

Some of the most common issues I've seen involve either certificate trust issues between the ISE pxGrid cert and the SMC cert or the 'Automatically approve new certificate-based accounts' setting is disabled in the ISE pxGrid Settings page and the client has not been manually Approved in the Administration > pxGrid Services > Client Management > Clients section.

Re: ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Fri, 01 Jul 2022 07:09:48 GMT

the integration is fine, i have the green circle for both ISE and SMC and this is the good signal. The problem is the ultimate state show me offline (XMPP) on ISE, how i can fix this issue?

i found this link with the same problem, but the solution not solve the problem

https://community.cisco.com/t5/network-access-control/stealthwatch-6-10-1-pxgrid-to-ise-2-3-not-functioning/m-p/3433866#M518158

attach images about this problem on ISE and SMC

Re: ISE Stealthwatch manager console Client offline

Greg Gibbs — Mon, 04 Jul 2022 02:20:31 GMT

As I stated in my previous response "SNA 7.4.1 integration with ISE 2.7 should be using pxGrid version 2 with WebSocket instead of XMPP."

The All Clients tab in the 2.7 pxGrid section only shows connections using XMPP (pxGrid version 1).

The Web Clients tab shows connections using WebSocket (pxGrid version 2).

Seeing (Offline) XMPP for your SMC connection is expected since it is using pxGrid version 2.

If the pxGrid connection status on the SMC side shows Connected, you should see your SMC client in the Web Clients tab in ISE with a Status = ON.

Re: ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Mon, 04 Jul 2022 02:27:32 GMT

Hi Greg

The connection On SMC is circle green (it is good). How can resolve this problem?

Please help me, I need you help

Do you have a paper o document or link with the step for this case?

How I can choose between Pxgrid1 or Pxgrid 2, what is the procedure?

Thanks

Re: ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Tue, 19 Jul 2022 05:28:55 GMT

Hi Greg

my deploy with last patch for 7.4.1 smc and sfc have a problem with ise 2.7 last patch. the SMC is not able to receive the mac address of endpoint. Please you help

Re: ISE Stealthwatch manager console Client offline

Greg Gibbs — Tue, 19 Jul 2022 23:38:00 GMT

There are a lot of moving parts to this solution, and simply providing screenshots from SMC is not sufficient enough information to provide any meaningful assistance.
The MAC address information from ISE requires that ISE has the IP-MAC binding. This would come from IP Device Tracking on the switch as described in the ISE Secure Wired Access Prescriptive Deployment Guide.

Is IPDT configured on the switch?
Does ISE show the IP-MAC binding for the session?

The User attributed to the flow record would require that ISE gets the username from an 802.1x User authentication session. Is there a successful user auth session in ISE related to this MAC address?
The rest of the details on the User Info page (email address, location, etc) would have to come from the direct integration between SMC and Active Directory.

Re: ISE Stealthwatch manager console Client offline

Juan Marilaf Millahual — Tue, 19 Jul 2022 23:48:44 GMT

Hi

Yes. ISE 2.7 with last patch have sucessful integration 802.1X with user (user221). The integrate of ISE with Active Directory is fine

The user221 is included in the group of domain users and this group is integrate within ISE

The user221 login on AD with your credentials and ISE made Authentication and Authorization

Also I tried use WMI with ISE-PIC but the result is same, no information about Mac address Client

Please you help

Re: ISE Stealthwatch manager console Client offline

Greg Gibbs — Wed, 20 Jul 2022 00:00:23 GMT

I've provided all the suggestions I can based on the limited details supplied.
I would suggest opening a TAC case to investigate in more detail on both the ISE and SNA platforms.