ISE Security Group Mapping download to ASA

[joeharb]

We are implementing Security Tags with an ASA and ISE.  We have generated the PAC and imported it into the ASA and they in sync.  The Security Groups are present in the ASA, but the IP to Security Group Mapping that was manually placed in ISE aren't downloaded.  We have configured the WLC as a speaker and these mappings are dynamically updated on the ASA.  Does the ASA need to additional configuration, ie does ISE need to be configured as a peer for the static mappings to be downloaded?

Please advise,

Joe

[joeharb]

Update:

I am testing with a username and enable password to see if this makes a difference.  It appears it now tries to deploy and says it is Updated but I don't see anything in the ASA.  All the ISE Diagnostic tests result in an invalid enable password.  I am logging into the ASA with the same creds without issue.  I have attempted several times with a copy and paste but it won't validate.

Any suggestions?

Thanks,

Joe