Cisco DNA and ISE Integration Issue

[Ciscorocks]

We are trying to integrate our Cisco DNA center deployment with ISE and are seeing an error that is stating a CA chain is broken. The error is referring to the chain being broken for issuer "CN=Certificate Services Root CA" this is under "certificate authority certificates". How can we renew this cert so that the chain is no longer broken so that we can get past this error? Do we need to renew the chain for the ISE internal root cert? Any info is appreciated.

[balaji.bandi]

You need to provide more information :

DNAC Version ?

ISE Version ?

is this Local Certs of Public Certs ?

Integration guide :

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/hardening_guide/b_dnac_security_best_practices_guide.html#task_zpl_4c2_rbb

https://community.cisco.com/t5/networking-knowledge-base/how-to-cisco-dna-center-ise-integration/ta-p/3896410

check some thread helpful :

https://community.cisco.com/t5/cisco-digital-network-architecture-dna/dna-and-ise-re-integration-problem/td-p/4112948

[Arne Bier]

Hey @Ciscorocks ,

Just out of interest, in your ISE deployment, do you see ongoing "Queue Link" Alarms ? If so, then the solution is to regenerate the ISE Internal CA. This is quick an easy and does not cause disruption. Of course, if you're using the internal ISE CA then please don't do this - you'll need to make a more comprehensive solution to ensure you don't break your client connectivity.

cheers 

[hslai]

@Ciscorocks Arne is correct that you would need check whether Cisco internal CA service also used for client authentications. In case it's not used for that, then you may follow the Queue-Link Alarm subsection of

• Syslog over Cisco ISE Messaging Service

[Ciscorocks · Accepted solution]

After re-generating the ISE internal root ca and then messaging cert we were able to get DNAC integrated. Make sure the "use DNA center certificate" in DNAC integration settings is unchecked.