topic Hello,We are also facing the in Network Access Control

ISE Internal error suddenly appear

M.Jallad — Wed, 13 Mar 2019 00:44:36 GMT

I started to see this error message suddenly

[500] Internal Error

Please contact system administrator. If you are the System Administrator please consult the logs.

ISE deployment consists of two nodes one carrying Administration persona (primary) , and monitoring (secondary) and the other carrying Administration persona (secondary) , and monitoring (primary) persona, the setup was running smoothly without any issues. ISE version was 1.2; and after this issue appeared we did the required troubleshooting with no luck ; so we upgraded both units to 1.3 and still facing the same issue.

We noticed a strange behavior on agent redirection ACL , when trying to reach basic services such as domain,DNS,.. (which are denied from redirection on the ACL) it appears to be redirected to ISE ( last permit ACE in redirection ACL counters increases contineously ) which shouldn't be the case in the posturing stage.

Anyone did face this issue , and what does this mean or have any ideas appreciate to share with us...

Can you post your auth.+ post

Saurav Lodh — Tue, 11 Nov 2014 22:32:03 GMT

Can you post your auth.+ post. policies? Since you are using 1.3 , you can expert the policies directly to your admin pc. While you face the above issue during posture, have you removed thed network cable and reconnected the client and tested the network access? are they able to go through it?

Hi,Do you have any admin

Naresh Ginjupalli — Sun, 16 Nov 2014 03:45:20 GMT

Hi,

Do you have any admin Access Restrictions enabled on your ISE node. If so please check from which IP address your are accessing the ISE GUI.

If you have no such ISE restrictions, please check with the showtech file and see if your NIC's are having the correct IP address and are not swapped.

If you are not having any issues with the above checks, then I would suggest to open a TAC case immediately.

Thanks,

Naresh

Hi Salodh,Attached the

M.Jallad — Tue, 18 Nov 2014 07:16:43 GMT

Hi Salodh,

Attached the exported policies.

You are right when removing the cable or clearing the authentication session or logging off NAC agent pops up normally and client get postured. However, when restarting the PC again the problem appears again.

I'm seeing the same issue,

hoytmann — Tue, 18 Nov 2014 22:06:33 GMT

I'm seeing the same issue, just upgraded to 1.3. Did you resolve your issue?

did you change ISE Hostname,

Venkatesh Attuluri — Thu, 20 Nov 2014 13:57:38 GMT

did you change ISE Hostname, DNS resolvable on the ISE nodes ?

Change the DNS entries to

Charlie Moreton — Thu, 20 Nov 2014 15:03:50 GMT

Change the DNS entries to point to the PSN.

Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.

Charles Moreton

Unfortunately issue still

M.Jallad — Tue, 25 Nov 2014 08:23:28 GMT

Unfortunately issue still there. did you have this issue on the previous version ?

Hi Naresh,I'm afraid this is

M.Jallad — Tue, 25 Nov 2014 08:34:58 GMT

Hi Naresh,

I'm afraid this is not related to ISE GUI access. You see , end user NAC agent is not popping up even if you wait. when checking further for troubleshooting i saw the above captured URL on switch (this is the agent provisioning URL redirect policy returned from ISE for clients posturing) ; the correct URL should be the posturing URL not this error page.

This issue happens when restarting client PC. however , if you clear authentication session manually on switch, it successfully completes client posturing. However, after the next log off or restart the problem re-appears.

I faced the same problem on

jai_chandra2001 — Fri, 26 Dec 2014 15:23:37 GMT

I faced the same problem on multiple PC's during deployment on fresh install 1.3. Bug CSCur94336. The trigger might not be the same, but may be you are going through the same issue.

Primary issue is that when the ISE sends a redirect, there is a session id assigned to it. Both switch and ISE are aware of it during the policy enforcement duration(redirect duration). For some reason I guess the switch or ISE was deleting the session id. So the ISE returns the error saying it isnt aware of the session. With what I read on this thread so far, didn't look like a configuration issue to me. But I think experts can throw more light on this.

Patch for this will be released in January.

Hi,Actually the bug was

M.Jallad — Tue, 30 Dec 2014 10:02:06 GMT

Hi,

Actually the bug was raised after we opened the case with cisco TAC ad they decided to release patches for 1.2 (already released) and 1.3 which will be released soon. however, we are working normally on 1.2.1 , so you can try it if you have urgent issues now.

Regards,

Muayad,

Hi, I think I have a similar

Michael Weller — Mon, 05 Jan 2015 14:47:48 GMT

Hi, I think I have a similar or maybe the very same issue. However, it applies to wireless and to guest / onboarding services only.

We do not do any posturing, but we get similar internal errors when redirected to the guest portal. Sometimes it also shows errors about unknown radius session.

TAC ticket regarding the issue is open, but we did not yet get a final analysis. This is a multiple WLC deployment using anchors for guest services. It seems that the choice of WLC in the mobility group/anchor to which the access point is actually registered somehow affects the frequency of this error but we are not sure about it.

I understand from the other posts, that it is clear, that this is an issue with 1.3. and latest 1.2 releases and not a Radius authenticator issue, right? (which would be helpful in our situtation since we can update ISE easier than WLC).

Regards,

Michael.

I think Cisco worked closely

jai_chandra2001 — Mon, 05 Jan 2015 15:55:47 GMT

I think Cisco worked closely with the switch(authenticator) to identify the root cause and eventually release the patch. So I would incline to think its on the ISE.

Sure , the issue was caused

M.Jallad — Tue, 06 Jan 2015 08:06:40 GMT

Sure , the issue was caused by ISE (exactly version 1.3) ; and not related to authenticator device (as the same authenticator was working normally on version 1.2.1).

Hi all,it turned out (well 99

Michael Weller — Thu, 08 Jan 2015 09:52:11 GMT

Hi all,

it turned out (well 99% likeliness) that we were struck by a different issue:

If you see error 500 in a wireless situation with mobility groups, esp. an anchor controller, consider this document: http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html#anc11 (I assume cco login is required).

In short: enable accounting ONLY on the (single; maybe active/standby) foreign controller, or disable it completely.

Otherwise all controllers send different session ids in their accounting messages to ISE confusing the latter. This is a long outstanding WLC bug CSCuo56780.

Regards,

Michael.

I think that I have the same

nrunge1 — Thu, 15 Jan 2015 23:37:05 GMT

I think that I have the same issue here. Just upgraded to 1.3, we use a WLC redirect for CWA (self service guest). It appears to happen only a very small percentage of the time. I have checked and double checked my DNS configuration.

I have a case open with TAC. Just sent over debug logs. I took a peek and the guest log has the error "exception while handling page error: portalSessionId is null or empty", which may or may not be related.

Hopefully TAC has some answers but my guess is that 1.3 patches will resolve this.

I can't say I didn't know what I was getting into moving to 1.3 :]

Hello,We are also facing the

pemasirid — Wed, 25 Feb 2015 12:25:03 GMT

Hello,

We are also facing the same issue.We see that browser is trying to redirect (see the attached printscreen) and also when we manualy entered the url with session id etc it given the internal server error message.

The strange thing is that it works for one SSID but it does not work for another SSID, all the configuration as same and on ISE we see it hits the Web Auth redirection authz policy. Client can resolve FQDN of ISE etc.?

Has anybody find any solution or workaround for this issue.

Thanks in advance

How many Wireless Controllers

Michael Weller — Thu, 26 Feb 2015 08:41:06 GMT

How many Wireless Controllers are involved in your situation? Is there a mobility group? (an active-standby HA config would count as one controller, since the standby does not do anything). Do you use anchor controllers? Maybe your SSIDs are anchored on different controllers?

If you have more than one controller, check if radius accounting is enabled for your SSIDs. If so, enable radius accounting at most on one of your controllers.

Multiple controllers, doing all accounting but with possibly different settings on different SSIDs, and maybe different timing issues involved, c/would cause your symptoms.

Check the link in my post above.

If you only have a single wlc, or already disabled accounting. Sorry, then I do not have an idea.

Michael.

Hi Michael,Thanks for your

pemasirid — Fri, 27 Feb 2015 20:30:47 GMT

Hi Michael,

Thanks for your response. In our case we have only two controllers in a high available scenario.

I have tested both accounting enable/disabled but get the same error. the client gets the redirect url with browser showing "web authentication" but it simply keep trying only and on ISE monitoring also I can see it hits the correct Authz policy (redirection).

I am wondering why one SSID works without any issue and why it doe not work for other SSID with the same settings..?

Any other thoughts as per your experience.?

Thanks in advance.

No, sorry. This scenario

Michael Weller — Sat, 28 Feb 2015 16:03:49 GMT

No, sorry. This scenario worked for me. I know - though - that there are apparently issues with WLCs creating consistent Radius session IDs and that ISE is easily confused about this and that this is one way to trigger an error 500 in ISE.

If you did not yet try, I'd recommend using latest 7.6. for WLC, 8.x has issues too. But this is also only a wild guess.

Michael.