Cisco_Firepower deployment issue

[Amen]

We were affected several times for an error that prevented us to continue with the deployment of any modifications in our Cisco Firepower, and the error seems to be related to ISE/SGT integration:





At the moment, we are using the following workaround: uncheck “SXP Topic” -> Save, then check back again “SXP Topic” -> Save:

After execution of this workaround, we can continue normally.


is there anyway to avoid that? Is there any know bug or information about this? Perhaps some commands we can run to gather information to help troubleshoot next time?

[Aref Alsouqi]

Are you using that security rule that has "DigIT_Infra" tag selected? if not, you can remove that rule. The error you shared seems to be talking about having that tag deleted, mabye there is an issue between ISE and your FMC that is preventing the synchronization from happening? Finally, if you are not using SXP then you can leave it off, you only need that if you are actually encapsulating the SGTs over L3 links.

[Amen]

Yes, we are using the “DigIT_Infra” SGT. That is the only one you can see in the screenshot, but the full list of all SGT is included in the scroll down window. This mans that is complaining about all of them.

As far as I understand, I need SXP between Firepower an ISE server, Communications between them are over internal L3 links. right?

[Aref Alsouqi]

For the integration itself I don't believe you need SXP as ISE and FMC are integrated via pxGrid. However, the SXP could be required if you want to propagate the SGTs over L3 links where the devices in the path (ISP CPE for instance) do not keep or process the tag. In that case SXP would be required, but as I said not for the integration between ISE and FMC.

[Rob Ingram]

@Amen the FMC will learn the SGT (and dynamic IP bindings) via the pxGrid integration to ISE. The SXP integration to ISE would be used if you are publishing static IP binding from ISE, optional not mandatory.

From the FMC expert mode, you can run the command adi_cli session will display the sessions sent from ISE to the FMC and run the command cat /var/sf/run/adi-health will provide information on the state to confirm this integration is working.