PXgrid Issue between ISE & SWA

[goudier2001]

I've followed the steps enabling PXgrid on ISE & SWA to share tagging but when testing the connectivity between SWA and ISE the following output is provided from SWA.

Does anyone know the issue or how to troubleshoot the problem?

Validating WSA client certificate ...
Success: Certificate validation successful

Validating ISE pxGrid Node certificate(s) ...
Success: Certificate validation successful
Success: Certificate validation successful

Checking connection to ISE pxGrid Node(s) ...
Trying primary PxGrid server...
Preparing TLS connection...

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Failure: Connection to ISE pxGrid Node failed.
Trying secondary PxGrid server...
Preparing TLS connection...

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Certificate validation error SSL Exception: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown.

Failure: Connection to ISE pxGrid Node failed.

Test interrupted: Fatal error occurred, see details above.

[goudier2001]

FYI 

ISE version is 3.2 P7

SWA version is 15.2.2

[amojarra]

Hello @goudier2001 

Thank you for the information

[1] Could you please confirm you have "Automatically Approve of PxGrid certificate" enabled

ISE GUI >> Administration >> PxGrid Services >> Settings

[2] Kindly check if all the necessary Certificates from ISE are imported and trusted in WSA

ISE GUI >> Administration >> System >> Certificates >> Certificate Authority >> Certificate Authority Certificates >> Export

[2-1] we need to import the Root CA first , submit & Commit, then Node CA, submit & Commit, and Endpoint CA, submit & Commit.

[3] when you create the PXGrid certificate in WSA, submit & Commit, then while importing to ISE please make sure "Trust for client Authentication and Syslog" is checked 

ISE GUI >> Administration >> System >> Certificates >> Certificate Management >> Trusted Certificates

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++