pxgrid error from ISE-PIC 2.6.0.156 to FMC 6.3.0.2

[Adam6225]

Hi,

Looking for assistance connecting pxgrid from ISE-PIC to FMC.

I followed this video closely http://www.labminutes.com/sec0285_ise_22_passiveid_pxgrid_1

But when I go to test connection from the FMC it throws up an error -

bulk download iter next failed XML errorNo error
Sending SSL alert:close notify
Failed to validate bulk download.

Anyone got any ideas. I have tried re issuing the certs from ISE. Still no success.

Thanks

[Surendra]

If the MnT node same as the pxGrid node ? If not, please import MnT node certificate's CA certificate to FMC as well. It is recommended to get both the pxGrid and MnT nodes certificates signed by the same CA to avoid any issues on the FMC.

[Adam6225]

Thanks for your reply....

I don't have a seperate MNT node.

In the guide I followed it just used the same root cert from the ISE-PIC server for both pxgrid server CA & MNT server CA.

I'm presuming this is supported on the ISE-PIC rather than just ISE. Not sure if it is enabled on ISE-PIC.

[Surendra]

By default, the Admin certificate for a node is a self-signed certificate and it does not come from the internal ISE CA server. However, your pxGrid node on the other hand comes from the internal CA server. If you can share the screen shots of the page Administration > System > Certificates > Certificate Management > System certificates, this will give us a fair idea.

[Adam6225]

Please see screenshot attached. Thanks Surendra

[Surendra]

As you can see, the CA of pxGrid certificate is not the same as the CA for the admin certificate. Bulk download is an API sent to the MnT node and it presents the admin certificate during the same. This will not be trusted by the FMC unless you import this self-signed certificate to the Trusted certificates on the FMC. the best way to go about this is to get these certificates for both pxGrid and the ISE server certificate used for Admin usage signed by a single CA, be it internal or External.

[Adam6225]

I went ahead and changed the admin & pxgrid certs. I signed them with my windows domain CA. I uploaded all of the root CA certs to both ISE & FMC. I also created a new FMC pxgrid cert signed by the same CA.

It seems like after all of this I have the exact same error message -

Failed to validate bulk download.

Do you have any other thoughts you can share on how to fix?

[fedor.solovev]

Hello,
Could you share how did you solve the task ?

[Adam6225]

Hey,

Its been awhile, but I think that I applied a patch or service pack or something similar.

As soon as I did that the problem went away.

Thanks