topic Re: ISE 1.2 Posture Update Issue in Network Access Control

ISE 1.2 Posture Update Issue

deepuvarghese1 — Mon, 11 Mar 2019 04:40:26 GMT

In ISE 1.2 below message is showing when we do a web posture update either manual or automatic.

"Remote address is not accessible. Please make sure update feed url, proxy address and proxy port are properly configured".

It was working fine for long time and all of a sudden it stopped working
and no changes have made on the network side.
https://www.cisco.com/web/secure/pmbu/posture-update.xml is working in the browser.

Few customers had reported the same. Boxes are installed with latest patch version 7.

We can upload the updates through offline mode.

I have experienced the same

mcrukshanfdo — Mon, 28 Apr 2014 20:39:57 GMT

I have experienced the same issue. Both the posture update feed URLs

1. https://www.cisco.com/web/secure/pmbu/posture-update.xml

2. https://www.perfigo.com/ise/posture-update.xml

give the same error, when the ISE boxes try to do the updates. But these URLs are accessible from outside.

A TCP dump taken from a box shows as "Certificate unkown Alert " (when it tries to update) for the received certificate from the other end. Then the ISE box sends a (FIN,ACK) and terminates the session.

The relevant pcap file is attached

Recently I had the same issue

descalante2007 — Wed, 14 May 2014 23:34:48 GMT

Recently I had the same issue. The dump clearly indicates a problem with a certificate, so I was able to fix it re-enabling all the factory certificates in the Certificate Store.

First I tried re-enabling one by one, but as I got the same result I tried re-enabling all of them at the same time

Regards.

I had the same issue on ISE 1

rtanner — Tue, 08 Mar 2016 21:57:58 GMT

I had the same issue on ISE 1.3 and 1.4 just now.

I resolved it by adding the Root CA (Geotrust) into the trusted certificates. I had to put the URL in my browser to determine who had issued the cert in the first place, then went to their website to get it, since it wasn't in the ISE to begin with.

Re: I had the same issue on ISE 1

Vinay-M. — Mon, 05 Mar 2018 05:32:29 GMT

Many Thanks Rtaner,

I had same problem from last 2 week and it wroked for me. Very different kind of certificate issue. I download certificate from Thawte and Hydrant IDE and imported into ISE trusted. Thanks a Ton for posting this solution. I had very difficult time becauseof this weird error.

Re: I had the same issue on ISE 1

Vinay-M. — Mon, 05 Mar 2018 05:33:46 GMT

Many Thanks to rtaner for posting this solution. I had this connectvity failing error to BlueCoat proxy and I tried to connect ISE with multiple Proxy IP and port and it kept failing.

Re: ISE 1.2 Posture Update Issue

Antonio Macia — Fri, 09 Mar 2018 08:59:45 GMT

Hello,

I ran into this issue and I solved it by adding the "QuoVadis Root CA2"CA as trusted certificate.

Regards.

Re: I had the same issue on ISE 1

emattison1 — Sat, 24 Mar 2018 21:14:12 GMT

This is still totally valid. I'm playing with 1.4 to go for the SISAS, and this has been bugging me. I downloaded the HydrantID SSL ICA G2 root cert, and that fixed it for me as well!

Thanks!

Re: ISE 1.2 Posture Update Issue

Ali — Sun, 25 Mar 2018 07:17:21 GMT

I also Ran into this Issue and found this below update.......

https://www.cisco.com/c/en/us/support/docs/field-notices/701/fn70122.html

*** Important Update on ISE Please read carefully ***

---------------------------------------------------------------------------

ISE connects to Cisco.com via SSL in order to obtain binary and data updates for Posture and BYOD. On February 14th the certificates used for the Posture Feed Server are being replaced. To prevent any issues with downloading Posture Feed Server updates, please go to software.cisco.com (LINK) and download the two new Root and Intermediate certificates and then import them into your Trusted Certificate store in ISE. When importing the certificates into ISE, please be sure to check the box to “Trust for authentication of Cisco Services”.

If the certificates are not updated before Feb 14^th then this change will prevent ISE from downloading new software packages directly from Cisco, but will not affect the configuration or operation of Posture or BYOD for end clients.

Re: ISE 1.2 Posture Update Issue

istafrica — Sun, 13 May 2018 18:22:18 GMT

Thank You.. this works like charm..Thumbs up

Re: ISE 1.2 Posture Update Issue

alihk1979 — Tue, 04 Sep 2018 12:20:32 GMT

Hello All , I am facing same problem with Ise 1.2 the problem is that I couldn't find "Trust for authentication of Cisco Services” to check on it, this option is missing from the certificate, any one has a solution for this.

Thank you

Re: ISE 1.2 Posture Update Issue

esen.emre — Thu, 15 Nov 2018 12:45:09 GMT

Thank You Ali,