topic Re: Cisco_Firepower deployment issue in Network Security

Cisco_Firepower deployment issue

Amen — Thu, 06 Feb 2025 07:53:15 GMT

We were affected several times for an error that prevented us to continue with the deployment of any modifications in our Cisco Firepower, and the error seems to be related to ISE/SGT integration:

At the moment, we are using the following workaround: uncheck “SXP Topic” -> Save, then check back again “SXP Topic” -> Save:

After execution of this workaround, we can continue normally.

is there anyway to avoid that? Is there any know bug or information about this? Perhaps some commands we can run to gather information to help troubleshoot next time?

Re: Cisco_Firepower deployment issue

Aref Alsouqi — Thu, 06 Feb 2025 17:42:19 GMT

Are you using that security rule that has "DigIT_Infra" tag selected? if not, you can remove that rule. The error you shared seems to be talking about having that tag deleted, mabye there is an issue between ISE and your FMC that is preventing the synchronization from happening? Finally, if you are not using SXP then you can leave it off, you only need that if you are actually encapsulating the SGTs over L3 links.

Re: Cisco_Firepower deployment issue

Amen — Tue, 11 Feb 2025 16:29:38 GMT

Yes, we are using the “DigIT_Infra” SGT. That is the only one you can see in the screenshot, but the full list of all SGT is included in the scroll down window. This mans that is complaining about all of them.

As far as I understand, I need SXP between Firepower an ISE server, Communications between them are over internal L3 links. right?

Re: Cisco_Firepower deployment issue

Aref Alsouqi — Tue, 11 Feb 2025 16:48:09 GMT

For the integration itself I don't believe you need SXP as ISE and FMC are integrated via pxGrid. However, the SXP could be required if you want to propagate the SGTs over L3 links where the devices in the path (ISP CPE for instance) do not keep or process the tag. In that case SXP would be required, but as I said not for the integration between ISE and FMC.

Re: Cisco_Firepower deployment issue

Rob Ingram — Tue, 11 Feb 2025 17:00:41 GMT

@Amen the FMC will learn the SGT (and dynamic IP bindings) via the pxGrid integration to ISE. The SXP integration to ISE would be used if you are publishing static IP binding from ISE, optional not mandatory.

From the FMC expert mode, you can run the command adi_cli session will display the sessions sent from ISE to the FMC and run the command cat /var/sf/run/adi-health will provide information on the state to confirm this integration is working.