ISE Smart Licensing problem

[knnielsen]

Hi,

We recently converted our ISE 2.4 patch 4 to Smart licensing. We also converted our existing licenses (Base and Plus).

It worked for approx. one week and now it has stopped communicating with Ciscos licensing system.

When I try to use the Refresh button on the licensing page, I receive the error "Smart Licensing refresh failed".  The last authentication was on 9th of February.

There is not much information in the log file - except for an "Send communcation error". But when I try to ping tools.cisco.com from the CLI, it works just fine.

I am considering deregistering and then registrer with the token again, but if it fails to re-register, I am in a bit of trouble (this ISE server is in production).

Any ideas for troubleshooting?

Best regards

Kenneth

[paul]

I would guess you changed something on your URL filtering/firewall side that is blocking the communication.  Pings won't really test the communication.

[knnielsen]

Hi,

I can see an established connection in our firewall, when I try to test the profiler feed.

but when i try to refresh the licensing - nothing goes to the firewall, as if it never leaves the ISE server.

There is not much error information in the log, except:

2019-02-19 09:34:06,659 ERROR [Thread-88][] cisco.nesla.agent.impl.AsyncRequestProcessor -::::- failed to send request / process response: SmartAgentMessageRenew
2019-02-19 09:34:06,659 ERROR [Thread-88][] cisco.nesla.agent.impl.AsyncRequestProcessor -::::- schedule next reg renew
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- --> received global notification. NotifyIdCertRenewFail
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- this inside globalcom.cisco.cpm.admin.license.sl.SmartAgentNotificationListener@xxxxxxxx
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- notification type: NotifyIdCertRenewFail -- failure: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- final formatted: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- fail message: Communication send error.
2019-02-19 09:34:06,659 INFO [Thread-88][] cisco.cpm.admin.license.LicenseHelper -::::- inside logging external
2019-02-19 09:34:06,660 INFO [Thread-88][] cpm.admin.license.sl.SmartAgentNotificationListener -::::- ID certificate renewal failed

Best regards

Kenneth

[jdargence]

Did you ever figure this out? I am seeing similar problems with my deployment

[Marcelo Morais]

Hi @jdargence 

 did you try to re-register with a new Token?

Hope this helps !!!

[jdargence]

I did. I generated a new Token and tried to re-register, but the errors don't go away. The last authorization on my licenses is December 03 2020

[Marcelo Morais]

Hi @jdargence 

 the Last Authorization = Dec 3, 2020 is not "a problem".

 Remember that:

"... If there is a change in the compliance status when synchronized with the CSSM server, the Last Authorization column of the Licenses table updates accordingly. In addition, when entitlements are no longer compliant, the number of days for which they are out of compliancy appears in the Days Out of Compliancy column..."

Please take a look at: Cisco ISE Licenses. search for Cisco ISE Smart Licensing.

Hope this helps !!!

[jdargence · Accepted solution]

Finally figured out my issue. We replaced an outdated ACS with ISE, but weren't able to use the ACS IP in the new server, so we added a NAT to redirect all traffic on our firewall to ISE's new IP. Unfortunately this NAT was also interfering with NATting to the internet. Once this was resolved, ISE was able to contact the Cisco licensing servers. 

[thomas · Accepted solution]

Suggest calling TAC for further troubleshooting of connectivity to CSSM.