Hello Team,
I've did it already multiple times and almost always i have to spend hours again to re-learn how to do it correctly.
ISE, just one node, pxgrid certificate generated (as all other ISE node certs) is signed by Microsoft NDES. pxgrid enabled - i have working integration with FMC, WSA - all of that is fine.
Now i have downloaded pxgrid-sdk-2.0.0.14 to run few samples. Configured both jks: self and trusted (and put in self.jks my own client pkcs12 + ca + mnt +pxgrid and put in trusted pxgrid+mnt+ca certs).
Now when running:
root@ubuntu:~/scripts/pxgrid/pxgrid-sdk-2.0.0.14/samples/bin# ./session_download.sh -a 192.168.1.117 -k self1.jks -p Krakow123 -t root1.jks -q Krakow123 -u ise_internal_test
------- properties -------
version=2.0.0.14
hostnames=192.168.1.117
username=ise_internal_test
password=
group=Session
description=null
keystoreFilename=self1.jks
keystorePassword=Krakow123
truststoreFilename=root1.jks
truststorePassword=Krakow123
--------------------------
Connecting...
13:47:53.865 [main] INFO com.cisco.pxgrid.Configuration - Connecting to host 192.168.1.117
13:47:54.394 [main] INFO com.cisco.pxgrid.Configuration - Connected OK to host 192.168.1.117
13:47:54.394 [main] INFO com.cisco.pxgrid.Configuration - Client Login to host 192.168.1.117
Exception in thread "main" com.cisco.pxgrid.GCLException
at com.cisco.pxgrid.GridConnection.connect(GridConnection.java:210)
at com.cisco.pxgrid.samples.ise.SampleHelper.connect(SampleHelper.java:231)
at com.cisco.pxgrid.samples.ise.SessionDownload.main(SessionDownload.java:110)
Caused by: java.lang.NullPointerException
at com.cisco.pxgrid.internal.smack.CustomSASLExternalMechanism.getAuthenticationText(CustomSASLExternalMechanism.java:50)
at org.jivesoftware.smack.sasl.SASLMechanism.authenticate(SASLMechanism.java:196)
at org.jivesoftware.smack.sasl.SASLMechanism.authenticate(SASLMechanism.java:190)
at org.jivesoftware.smack.SASLAuthentication.authenticate(SASLAuthentication.java:190)
at org.jivesoftware.smack.tcp.MyXMPPTCPConnection.loginNonAnonymously(MyXMPPTCPConnection.java:355)
at org.jivesoftware.smack.AbstractXMPPConnection.login(AbstractXMPPConnection.java:457)
at org.jivesoftware.smack.AbstractXMPPConnection.login(AbstractXMPPConnection.java:415)
at com.cisco.pxgrid.Configuration.connect(Configuration.java:344)
at com.cisco.pxgrid.GridConnection.connect(GridConnection.java:129)
... 2 more
In the packet captures i do see connection to node port 5222, SSL session negotiated correctly, Application (encrypted data exchange) in several packets and the the client disconnects. It looks like application issue: xmpp SASL authentication failing because of some reason.
I run all trace debugs for pxgrid* but after 1h of reading of those debugs gave up.
I have also executed:
root@ubuntu:~/scripts/pxgrid/pxgrid-sdk-2.0.0.14/samples/bin# ./create_account.sh -a 192.168.1.117 -k self1.jks -p Krakow123 -t root1.jks -q Krakow123 -u ise_internal_test
------- properties -------
version=2.0.0.14
hostnames=192.168.1.117
username=ise_internal_test
password=
group=Session
description=null
keystoreFilename=self1.jks
keystorePassword=Krakow123
truststoreFilename=root1.jks
truststorePassword=Krakow123
--------------------------
HTTP status=OK
password: AewIrAsP1OnGPgVS
But after this i still do not see ise_internal_test in ISE GUI pxgrid clients (i have autoapproval for password based clients). (i guess that is for password based authentication -> are there any samples showing how to use it ? in REAME this script is not mentioned).
I have also tried this:
root@ubuntu:~/scripts/pxgrid/pxgrid-sdk-2.0.0.14/samples/bin# ./session_subscribe.sh -a 192.168.1.117 -k self1.jks -p Krakow123 -t root1.jk-q Krakow123 -u ise_internal_test -w AewIrAsP1OnGPgVS
------- properties -------
version=2.0.0.14
hostnames=192.168.1.117
username=ise_internal_test
password=AewIrAsP1OnGPgVS
group=Session
description=null
keystoreFilename=self1.jks
keystorePassword=Krakow123
truststoreFilename=root1.jks
truststorePassword=Krakow123
--------------------------
14:13:58.930 [Thread-1] INFO com.cisco.pxgrid.ReconnectionManager - Started
Connecting...
14:13:58.999 [Thread-1] INFO com.cisco.pxgrid.Configuration - Connecting to host 192.168.1.117
14:13:59.762 [Thread-1] INFO com.cisco.pxgrid.Configuration - Connected OK to host 192.168.1.117
14:13:59.762 [Thread-1] INFO com.cisco.pxgrid.Configuration - Client Login to host 192.168.1.117
14:13:59.764 [Thread-1] ERROR com.cisco.pxgrid.ReconnectionManager - Retry connect failed null
Client returns this serious error, application is still running, packet captures show just correct xmpp session:
When the new session arrives on MNT i do not receive anything but just see connection retries.
Any ideas how to make it working ? Why SASL is failing ? Any other well defined restrictions ? Like specific SAN fields in certs ?
I know that i could use self signed certificates to make it simple - but i am not allowed.
Both ise pxgrid and client cert do have right EKU (client+server).
Thanks,
Michal
