Troubleshoot the Migration Tool

Unable to Start the Migration Tool

Condition

Unable to start the migration tool.

Action

Verify that Java JRE, Version 1.8 or later, is installed on the migration machine and that it is correctly configured in the system path and classpath.

Troubleshoot Connection Issues in the Migration Tool

If the migration tool fails to connect to Cisco Secure ACS or ISE, check the migration.log file to identify the problem.

Error Message

The following error message is displayed if the Cisco Secure ACS or ISE host name is not resolvable: "UnknownHostException: hostname"

Action

  • Ensure that the Cisco Secure ACS or ISE hostname is resolvable from the client machine where you run the migration tool.

  • Check the DNS configuration and connectivity.

Error Message

The following error message is displayed if the Cisco Secure ACS or Cisco ISE hostname entered in the migration tool does not match the name in the certificate: "hostname in certificate didn't match: <hostname> != </hostname_in_certificate>"

Action

Ensure that the certificate's Common Name in the Subject field or DNS name in Subject Alternate Name field in Cisco Secure ACS and Cisco ISE matches the Hostname provided in the migration tool.

Error Message

The following error message is displayed if the Cisco Secure ACS and ISE certificates are not trusted by the migration tool: "SSLHandshakeException: unable to find valid certification path to requested target"

Action

Ensure that Cisco Secure ACS and Cisco ISE certificates are trusted by adding the required certificates in the Settings > Trusted Certificates page in the Cisco Secure ACS to Cisco ISE Migration Tool.

Error Messages Displayed in Logs

Connection Error

Condition

The following error message is displayed in the log: “Hosts: Connection to https://hostname-or-ip refused: null”. And, the object is reported while migrating to Cisco ISE.

Action

  • Make sure that the migration application machine is connected to the network and configured correctly.

  • Make sure that the Cisco ISE appliance is connected to the network and that it is configured correctly.

  • Make sure that the Cisco ISE appliance and the migration machine are able to connect to each other over the network.

  • Make sure that the hostname (if any) used in the Cisco ISE primary node is resolvable within the DNS when the migration tool connects to Cisco ISE.

  • Make sure that the Cisco ISE appliance is up and running.

  • Make sure that the Cisco ISE application server service is up and running.

I/O Exception Error

Condition

The following error message is displayed in the log:

“I/O exception (org.apache.http.NoHttpResponseException) caught when processing request: The target server failed to respond”.

Action

  • Make sure that the Cisco ISE application server service is up and running.

  • Make sure that the Cisco ISE web server thresholds have not been exceeded or that there are no memory exceptions.

  • Make sure that the Cisco ISE appliance CPU consumption is not 100 percent and that the CPU is active.

Out of Memory Error

Condition

The following error message is displayed in the log:

“OutofMemory”.

Action

Increase the Java heap size to at least 1 GB.

Default Folders, Files, and Reports are Not Created

Condition

The migration tool fails to create default folders, log files, reports, and persistence data files.

Action

Make sure the user has file-system writing privileges and that there is enough disk space.

Migration Export Phase is Very Slow

Condition

The export phase of the migration process is very slow.

Action

Restart the Cisco Secure ACS appliance before starting the migration process to free up memory space.

Report Issues to Cisco TAC

If you cannot locate the source and potential resolution for a technical issue or problem, you can contact a Cisco customer service representative for information on how to resolve the issue. For information about the Cisco Technical Assistance Center (TAC), see the Cisco Information Packet publication that is shipped with your appliance or visit the following website:

http://www.cisco.com/cisco/web/support/index.html

Before you contact Cisco TAC, make sure that you have the following information ready:

  • The appliance chassis type and serial number.

  • The maintenance agreement or warranty information (see Cisco Information Packet).

  • The name, type of software, and version or release number (if applicable).

  • The date you received the new appliance.

  • A brief description of the problem or condition you experienced, the steps you have taken to isolate or re-create the problem, and a description of any steps you took to resolve the problem.

  • Migration logfile (...migration/bin/migration.log).

  • All the reports in the config folder (...migration/config).

  • Cisco Secure ACS, Release 5.5 or above log files.

  • Cisco Secure ACS, Release 5.5 or above build number.