ISE / Stealtwatch treat mitigation doesnt work

[AndiBuchmann157]

hi,

my ise and stealthwatch are connected  via pxgrid. i followed every step of the " Deploying Cisco Stealthwatch 6.9 with Cisco Identity Services Engine (ISE) 2.2 using Cisco Platform Exchange Grid (pxGrid)" Guide from John Eppich and used the ISE internal CA.

My ISE and Stealthwatch are connected as you can see in the screenshots right here:

thanks in advance!

[jeppich]

Hey Andreas,

Do you have the aaa server radius dynamic author command configured on your switch?

Thanks,

John

jeppich@cisco.com

[AndiBuchmann157]

Hi John,

thanks for you reply!

Yes, its activated, just doublechecked it

Another point which I am worried about is, I don’t see a IP adress of the host in the live log:

--> see attached image

Would it be helpful for you, if a attach the switch configs?

Thanks in advance and regards,

Andreas

[jeppich]

Hey Andreas,

This is most likely a switch configuration issue, please refer to: https://developer.cisco.com/fileMedia/download/63e057cc-beb1-4f66-9836-68d3391f7f0a

Look "Under "802.1X (optional)", you should see the required commands for the switch.  Please check to see if you have these configured on your switch.  More specifically, dhcp snooping, and ip device tracking should be turned on, and you have radius accounting updates configured.

We can also setup a webex, if this still is not working.

Thanks,

John

jeppich@cisco.com

[AndiBuchmann157]

i will check this tomorrow when i am back at the office!

thank you very much for all the effort john!

will get back to you asap!!

[paul]

I don't believe you need DHCP snooping although it is a security best practice we roll out with ISE typically.  IP device tracking should give you the IP information of the attaching host.

[AndiBuchmann157]

hi guys,

we made a step into the right direction - for now i can see the username and the ip adress, as you can see here:

BUT if i try to put a host in quarantine it says the smc is not connected to the ise, but "obviously" it is:

Thanks and regards,

Andreas

[jeppich]

Hey Andreas,

Let's schedule a webex. Email me directly to schedule a webex for next week.  Let me know what days and times work best for you.

Thanks,

John

jeppich@cisco.com

[hslai · Accepted solution]

As mentioned in Re: Stealthwatch EPS Integration, the setup has ISE 2.2 Patch 1, which has CSCvc81676, so I suggested to apply Patch 2.

[AndiBuchmann157]

i installed patch 2 this morning, but i still can not find any information about the CSCvc81676 - as i already mentioned before..what is that bug about?

[AndiBuchmann157]

done

[hslai]

Did applying patch 2 resolve the issue? The bug is on this issue exactly.

[AndiBuchmann157]

nope it is not. can you provide me any link where i can find more info about that?

i think it is still a little configuration issue, waiting for John's answer atm to schedule a Webex with him