pxGrid - 503 Service unavailable

[Antonio Macia]

Hi,

I'm trying to create an account for the integration in pxGrid of the Palo Alto's TrustSec plug-in but I'm getting an error saying that the service is not available. This is the first pxGrid client I'm registering in ISE.  I run a diagnostic test but it doesn't return any error. How can I debug this?

Regards.

[balaji.bandi]

what is the version of ISE, pxgrid enabled on ISE side ?

can you post output :

# show application status ise

you can check the logs :

show logging application pxgrid/pxgrid-XXXX.log

[Antonio Macia]

Hi Balaji,

Here is the output. pxGrid service is enabled on the PSN node but I don't see any reference of it on the command below apart for the pxGrid cloud agent which is actually not enabled because we don't need it.

ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 10434
Database Server running 140 PROCESSES
Application Server running 25530
Profiler Database running 17466
ISE Indexing Engine running 27004
AD Connector running 29840
M&T Session Database running 17245
M&T Log Processor running 25772
Certificate Authority Service running 28733
EST Service running 67115
SXP Engine Service running 29608
TC-NAC Service disabled
PassiveID WMI Service disabled
PassiveID Syslog Service disabled
PassiveID API Service disabled
PassiveID Agent Service disabled
PassiveID Endpoint Service disabled
PassiveID SPAN Service disabled
DHCP Server (dhcpd) disabled
DNS Server (named) disabled
ISE Messaging Service running 13477
ISE API Gateway Database Service running 15976
ISE API Gateway Service running 21971
Segmentation Policy Service disabled
REST Auth Service disabled
SSE Connector disabled
Hermes (pxGrid Cloud Agent) disabled

Regarding the log file, how can I list a log file in particular?

ise/admin# show logging application ?
<WORD> Application log file name (Max Size - 255)
> Output Redirection.
| Output modifiers.
<cr> Carriage return.

ise/admin# show logging application pxgrid
cat: /opt/CSCOcpm/logs/pxgrid: Is a directory
% Error: ise Application log output generated Errors

ise/admin# show logging application pxgrid tail
tail: error reading '/opt/CSCOcpm/logs/pxgrid': Is a directory
tail: /opt/CSCOcpm/logs/pxgrid: cannot follow end of this type of file; giving up on this name
tail: no files remaining
% Error: <A0>V<A1>><A0>U Application log output generated Errors

Regards.

[balaji.bandi]

I am missing something here - You have PX Grid enabled  ( what ISE version ?)

click >Administration >System >Deployment > node_name  ( General Settings)

[Antonio Macia]

Running ISE 3.1.

[Antonio Macia]

Didn't mention it but at the moment I'm running in evaluation mode. Don't think it makes any difference....

[balaji.bandi · Accepted solution]

evaluation should work too.  Do you have any Firewall between ?

Try below :

curl -k https://PXGRDI:8910/pxgrid/control/version

[Antonio Macia · Accepted solution]

No firewall.

Running the command returns "2.0"

That might be the issue. The Palo Alto plug-in is compatible with version 1.0 only....

[balaji.bandi]

Check the compatability then.

[Charlie Moreton · Accepted solution]

You are correct, ISE 3.1 uses pxGrid 2.0 and does not use pxGrid 1.0, that functionality has been dropped.  It's there in ISE 3.0, so if this is a feature you NEED, you can wait for Palo Alto to update or you can downgrade ISE.

[jworley79]

I ran into this 503 error.  It was because I didn't have password-based account creation enabled for pxgrid.

Once I enabled it, no more 503 errors and success.