ISE - advise on monitoring and alert switches with SXP TrustSec issues

[SergGu]

Hello Cisco ISE Experts,

The customer is concerned about Switches with broken SXP or incomplete TrustSec configuration etc. What are the strategies for checking 500+ switches for health? The core is configured for SXP and distribution and edgefor inline propagation.

"WorkCenters > TrustSec > Overview > Dashboard" provides really off-the-scale information, so I decided to scalp actual network devices for stats/errors. I was hoping ISE will give some reports, but so far, it does not look like ISE reports will be enough. "SXP Connections" is completely empty. "SXP Devices" only lists devices with SXP peering.

TrustSec Troubleshooting Guide contains a variety of commands, but perhaps you can recommend the killer ones. Or some unorthodox strategies

[SergGu]

BRKSEC-3690 Advanced Security Group Tags (SGT) The Detailed Walk Through recommends the following main commands:

SGACL Download Errors
• Validate AAA is reachable with “show aaa servers”
• Validate the device has a PAC with “show cts pac all”
• Validate the device can communicate with ISE by checking environmental data “show cts environmental-data”
• Check ISE to make sure the SGACL is formatted properly
• No IP/SGT on switch because of an error in device tracking
• TrustSec communities Troubleshooting Guide https://communities.cisco.com/docs/DOC-69479

[andrewswanson]

I find the following useful on ISE 2.6 patch 7

To check on NADs successfully updating CTS environment data on ISE:

Go to Operations > Reports > Endpoints and Users > RADIUS Authentications

In the "Identity" search box enter #CTSREQUEST#

To check on ISE SXP peerings:

Go to Work Centers > Trustsec > SXP > SXP Devices

SXP device status for each device is shown as ON or OFF

hth
Andy

[jeaves@cisco.com · Accepted solution]

The 'Verify Deploy' function found at the top of the ISE policy matrix is useful. It logs into devices (needs credentials under the Network Device entry), retrieves IP:SGT mappings and policies and checks if the correct policies are downloaded. Result shown at Operations > Reports > TrustSec > Trustsec Deployment Verification. Doesn't check SXP connections or inline tagging but gets to the heart of policy and enforcement.

[SergGu]

Verify Deploy generates "61031: TrustSec deploy verification failed to reach NAD" for each device (without exception). From your experience, what are the pre-requirements?

Do I need to provide SSH credentials for each NAD/device? I tried to check the documentation but was not able to see the list of commands ISE will use on Cisco Switches (in case one is willing to create a limited AAA set). I can see PAC status and "Send configuration changes to device Using > CoA" ticked, but no SSH credentials defind.

Your help is highly appreciated. Thanks!