ISE 3.2 Connecting to DNAC 2.3.3.6 - pxGrid Certificates

whitneyj2092 · ‎03-06-2023

Hello, I am attempting to connect my ISE 3.2 instance to DNA Center. I am able to get through the first 3 steps of the connection process but I error out on the last step.

The error says "Failed to download/process pxGrid endpoint certs from Cisco ISE".

I have searched online and I think it is an issue with some of my certificates being self-signed and some being CA signed. I have deleted and created my own certificates for pxGrid and have them self-signed as far as I can tell.

Does anyone know how the certificates need to be arranged/set up to enable DNAc and ISE pxGrid communication? Any help is appreciated.

*EDIT*

I get an ISE alarm that says "ERS identified deprecated url.The request url is deprecated and recommended avoid using it"

balaji.bandi · ‎03-06-2023

check certs :

https://community.cisco.com/t5/networking-knowledge-base/how-to-cisco-dna-center-ise-integration/ta-p/3896410

https://community.cisco.com/t5/networking-knowledge-base/cisco-ise-overview-and-integration-with-cisco-dna/ta-p/4137641

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

whitneyj2092 · ‎03-06-2023

Thanks for the reply, I checked through both of those articles and I still do not understand how I create certificates. The FQDN needs to be consistent as the certificate uses this info to create the association. I still get the same error.

sroic · ‎09-04-2023

Hi @whitneyj2092 ,

I stumbled upon your post while looking for a solution to our very similar case (depreced url etc). After unsuccessfully trying steps from the guide I managed to fix it with disabling/enabling ERS (Administration > System > Settings > API settings > API service settings, disabled all and enabled back). Didn't hope for much but after constantly getting stuck at 4 step it passed without issues.

Not sure why it helped but we changed certs lately and had a lot of issues with the wrong cert being used for all the stuff, even after deleting them from cert store. Could be that this one was still stuck or smh. Anyway, not sure it will help you but maybe it does for someone so wanted to share.