ANC correlation error

[Suptech]

Hi,

I have my FMC running 7.7 version integrated with ISE using pxGrid and the tests return successful connection with ISE. After configuring a ANC correlation rule to quarantine the source endpoint with ISE I get this error in the "Correlation Status" logs: "Unknown error processing ISE command, view error logs for details"

The integration was working until it stopped working suddenly.

Any idea?

Regards,

[Ben Weber]

Given that the issue only occurred after configuring the ANC rule, it is likely an issue with a policy mismatch in ISE or the service not being available.

Have you confirmed the policy name matches in ISE and that ANC is configured in ISE?

[Suptech]

Hi,

I have reconfigured the integration between FMC and ISE using the new mode. Recreated the ANC policy in ISE and recreated the FMC instance but the issue persists. In the policy set there is no match in the exception rules where the ANC is applied. I'll try to get some info from the debug logs in ISE.

Regards

[Suptech · Accepted solution]

I finally fixed it. The issue was on the device-tracking IP policy in the switch which was not enabled so ISE was not aware of the IP of the endpoint and couldn't apply any ANC policy. Configured the device-tracking policy and right after started seeing the IP when running the "show auth sess int X det" command. FMC correlation policy working back.

Thanks