03-08-2020 12:22 PM - edited 03-08-2020 12:23 PM
Hi all, anyone shed any light on a weird issue we've been seeing with our DNAC cluster (running 1.3.3) and ISE (2.6) whereby we can join DNAC and ISE together okay but we can't get DNAC to manage policy and set ISE to read-only, the save button is blanked out?
Basically we've gone through the steps of building ISE and enabling PXGRID, ERS, SSH, CA signed certs and auto-approving new connections in ISE and everything gets added correctly - we see online/active nodes in both DNAC and ISE and certs exchanged as we'd expect........but DNAC seems to be stuck when it comes to actually taking controlling of ISE (or vice versa).
We had an issue before so ripped out ISE and rebuilt the ISE nodes from scratch and since then DNAC seems to be stuck in a weird state of allowing the new AAA servers to be added (as per build docs) but not being able to administer ISE?
Attached is a screenshot from DNAC/Policy but it looks the same as if ISE hasn't actually been added - obviously DNAC says ISE is ACTIVE and ISE see's DNAC in PXGRID correctly.
Just wondering if anyones seen this issue or knows how to completely delete ISE out of DNAC (including all backend objects) so we can re-add it without having to do a DNAC rebuild? Have a TAC case out but not getting much traction.
03-15-2020 07:17 PM
This might help.
https://community.cisco.com/t5/cisco-digital-network/dna-and-ise-integration-problem/td-p/3715209
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide