ISE Tustsec SGACL not pushed to switch

[KelvinT]

ISE 3.2 patch 3
Cat4710 switch

Hello,

this is a new TrustSec deployment.  All other ISE/802.1x features are working correctly. 

at some point the SGACL was successfully pushed to the switch.  For whatever reason the new SGACL is not being pushed with the error message below. 

Any ideas?  Thanks

Nov  2 14:34:20.064: CTS-coa-ev:rbacl(CAFC_Deny_RDP) doesn't exist
Nov  2 14:34:20.064: Ignoring the CoA message rbacl = CAFC_Deny_RDP-0002. Continuing to process the other CoA messages.
Nov  2 14:34:20.064: CTS-coa-ev:AAA attr name (ssg-command-code) type (490)
Nov  2 14:34:20.064: CTS-coa-ev:Ignoring unsupported attr(ssg-command-code)
Nov  2 14:34:20.064: CTS-coa-ev:Continue to next attr

[thomas]

Not enough information about ISE or the switch to know what might be causing problems. See How to Ask The Community for Help .   I suggest calling TAC to help you troubleshoot.

[hslai]

TrustSec is egress enforcement and a switch will only download an SGACL if it knows about the destination. If your switch does have CAFC_Deny_RDP, please do contact TAC to troubleshoot

I assume your switch is of cat4500 series as Cisco has no cat4710 switch.