配置ISE 2.4 pxGrid IND 1.6.1集成

简介

本文档介绍如何配置和排除通过pxGrid（平台交换网格）的Identity Services Engine(ISE)2.4和Industrial Network Director 1.6.1-4集成故障。 思科IND以pxGrid作为发布者注册，并将有关终端属性的信息发布到IOTASSET词典的ISE。

先决条件

要求

Cisco 建议您具有以下主题的基础知识：

• 思科身份服务引擎

• 思科工业网络导向器

使用的组件

本文档中的信息基于以下软件和硬件版本：

• 思科身份服务引擎版本2.4 p6
• 工业网络导向器1.6.1-4

配置

高级流程图

1. IND通过pxGrid版本2在ISE pxGrid节点上向ISE注册。来自IND(application.log)的相应日志：

2019-05-22 14:31:17,770:INFO:qtp281049997-52711:PxgridPublisher:: Connect start
2019-05-22 14:31:17,770:INFO:qtp281049997-52711:PxgridPublisher:: Hostname:WIN2012-AAA IpAddress:10.62.145.130
2019-05-22 14:31:17,770:INFO:qtp281049997-52711:PxgridPublisher:: pxGrid RestBaseUrl:https://WIN2012-AAA:8910/pxgrid/ind/asset/
2019-05-22 14:31:17,770:INFO:qtp281049997-52711:PxgridController:: Send Request ServiceRegister invoked with pxGridServer(s) [ISE24-1ek.example.com]
2019-05-22 14:31:17,770:INFO:qtp281049997-52711:PxgridController:: Sending ServiceRegister request to pxGridServer ISE24-1ek.example.com
2019-05-22 14:31:17,786:INFO:qtp281049997-52711:PxgridController:: Request={"name":"com.cisco.endpoint.asset","properties":{"wsPubsubService":"com.cisco.ise.pubsub","restBaseUrl":"https://WIN2012-AAA:8910/pxgrid/ind/asset/","assetTopic":"/topic/com.cisco.endpoint.asset"}}
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Response={"id":"76d4abaf-9efd-4c68-a046-79e049564902","reregisterTimeMillis":"300000"}
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Send Request ServiceLookup invoked with pxGridServer(s) [ISE24-1ek.example.com]
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Sending ServiceLookup request to pxGridServer ISE24-1ek.example.com
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Request={"name":"com.cisco.ise.pubsub"}
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Response={"services":[{"name":"com.cisco.ise.pubsub","nodeName":"ise-pubsub-ise24-1ek","properties":{"wsUrl":"wss://ISE24-1ek.example.com:8910/pxgrid/ise/pubsub"}}]}
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridPublisher:: wsUrl=wss://ISE24-1ek.example.com:8910/pxgrid/ise/pubsub
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Send Request AccessSecret invoked with pxGridServer(s) [ISE24-1ek.example.com]
2019-05-22 14:31:17,911:INFO:qtp281049997-52711:PxgridController:: Sending AccessSecret request to pxGridServer ISE24-1ek.example.com
2019-05-22 14:31:17,926:INFO:qtp281049997-52711:PxgridController:: Request={"peerNodeName":"ise-pubsub-ise24-1ek"}
2019-05-22 14:31:17,926:INFO:qtp281049997-52711:PxgridController:: Access Secret recieved
2019-05-22 14:31:17,926:INFO:qtp281049997-52711:PxgridPublisher:: Client created

如日志所示，IND已注册assetTopic

2.启用pxgrid探测功能的ISE PSN可批量下载现有pxGrid资产(profiler.log):

2019-05-22 14:39:25,817 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- New services are: [Service [name=com.cisco.endpoint.asset, nodeName=ind2, properties={wsPubsubService=com.cisco.ise.pubsub, restBaseUrl=https://WIN2012-AAA:8910/pxgrid/ind/asset/, assetTopic=/topic/com.cisco.endpoint.asset}]]
2019-05-22 14:39:26,011 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- NODENAME:ind2
2019-05-22 14:39:26,011 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- REQUEST BODY{"offset":"0","limit":"500"}
2019-05-22 14:39:26,046 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Response status={}200
2019-05-22 14:39:26,046 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Content: "OUT_OF_SYNC"
2019-05-22 14:39:26,047 INFO [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Status is :"OUT_OF_SYNC"
2019-05-22 14:39:26,047 DEBUG [ProfilerINDSubscriberPoller-56-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Static set after adding new services: [Service [name=com.cisco.endpoint.asset, nodeName=ind, properties={wsPubsubService=com.cisco.ise.pubsub, restBaseUrl=https://WIN2012-AAA:8910/pxgrid/ind/asset/, assetTopic=/topic/com.cisco.endpoint.asset}], Service [name=com.cisco.endpoint.asset, nodeName=ind2, properties={wsPubsubService=com.cisco.ise.pubsub, restBaseUrl=https://WIN2012-AAA:8910/pxgrid/ind/asset/, assetTopic=/topic/com.cisco.endpoint.asset}]]
2019-05-22 14:39:26,052 INFO [ProfilerINDSubscriberBulkRequestPool-80-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- NODENAME:ind2
2019-05-22 14:39:26,052 INFO [ProfilerINDSubscriberBulkRequestPool-80-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- REQUEST BODY{"offset":"0","limit":"500"}
2019-05-22 14:39:26,111 INFO [ProfilerINDSubscriberBulkRequestPool-80-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Response status={}200
2019-05-22 14:39:26,111 INFO [ProfilerINDSubscriberBulkRequestPool-80-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Content: {"assets":[{"assetId":"100","assetName":"WIN2012-CHILD","assetIpAddress":"10.62.145.131","assetMacAddress":"00:50:56:b6:46:87","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":"SEC_TAG2"}]},{"assetId":"101","assetName":"win2012.example.com","assetIpAddress":"10.62.145.72","assetMacAddress":"00:50:56:9c:3f:92","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":""}]}]}
2019-05-22 14:39:26,111 DEBUG [ProfilerINDSubscriberBulkRequestPool-80-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Parsing bulk response {"assets":[{"assetId":"100","assetName":"WIN2012-CHILD","assetIpAddress":"10.62.145.131","assetMacAddress":"00:50:56:b6:46:87","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":"SEC_TAG2"}]},{"assetId":"101","assetName":"win2012.example.com","assetIpAddress":"10.62.145.72","assetMacAddress":"00:50:56:9c:3f:92","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":""}]}]}

3.在IND上发现新终端（终端需要使用协议发现，否则终端不会被识别为pxGrid资产，不会通过pxGrid与ISE共享）。

4. IND将此信息发布到ISE pxGrid节点

5.通过pxGrid探测功能的PSN接收此数据(profiler.log):

2019-05-22 15:20:40,616 DEBUG [Grizzly(2)][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Parsing push notification response: {"asset":{"assetId":"101","assetName":"win2012.example.com","assetIpAddress":"10.62.145.72","assetMacAddress":"00:50:56:9c:3f:92","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":"SEC_TAG2"}]},"opType":"UPDATE"}
2019-05-22 15:20:40,616 DEBUG [Grizzly(2)][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- sending endpoint to forwarder{"assetId":"101","assetName":"win2012.example.com","assetIpAddress":"10.62.145.72","assetMacAddress":"00:50:56:9c:3f:92","assetVendor":"VMware","assetProductId":"Unknown","assetSerialNumber":"","assetDeviceType":"Server","assetSwRevision":"","assetHwRevision":"","assetProtocol":"NetBIOS","assetConnectedLinks":[],"assetCustomAttributes":[{"key":"assetGroup","value":"Root"},{"key":"assetTag","value":"SEC_TAG2"}]}
2019-05-22 15:20:40,617 INFO [Grizzly(2)][] cisco.profiler.infrastructure.probemgr.Forwarder -::- Forwarder Mac 00:50:56:9C:3F:92 MessageCode null epSource PXGRIDPROBE
2019-05-22 15:20:40,617 DEBUG [forwarder-2][] cisco.profiler.infrastructure.probemgr.ForwarderHelper -:ProfilerCollection:- sequencing Radius message for mac = 00:50:56:9C:3F:92
2019-05-22 15:20:40,617 DEBUG [forwarder-2][] cisco.profiler.infrastructure.probemgr.Forwarder -:ProfilerCollection:- Processing endpoint:00:50:56:9C:3F:92
2019-05-22 15:20:40,618 DEBUG [forwarder-2][] com.cisco.profiler.im.EndPoint -:ProfilerCollection:- filtered custom attributes are:{assetGroup=Root, assetTag=SEC_TAG2}
2019-05-22 15:20:40,618 DEBUG [forwarder-2][] cisco.profiler.infrastructure.probemgr.Forwarder -:ProfilerCollection:- Filtering:00:50:56:9C:3F:92
2019-05-22 15:20:40,618 DEBUG [forwarder-2][] cisco.profiler.infrastructure.probemgr.Forwarder -:ProfilerCollection:- Endpoint Attributes:EndPoint[id=<null>,name=<null>]
MAC: 00:50:56:9C:3F:92
Attribute:BYODRegistration value:Unknown
Attribute:DeviceRegistrationStatus value:NotRegistered
Attribute:EndPointProfilerServer value:ISE24-1ek.example.com
Attribute:EndPointSource value:PXGRIDPROBE
Attribute:MACAddress value:00:50:56:9C:3F:92
Attribute:NmapSubnetScanID value:0
Attribute:OUI value:VMware, Inc.
Attribute:PolicyVersion value:0
Attribute:PortalUser value:
Attribute:PostureApplicable value:Yes
Attribute:assetDeviceType value:Server
Attribute:assetGroup value:Root
Attribute:assetHwRevision value:
Attribute:assetId value:101
Attribute:assetIpAddress value:10.62.145.72
Attribute:assetMacAddress value:00:50:56:9c:3f:92
Attribute:assetName value:win2012.example.com
Attribute:assetProductId value:Unknown
Attribute:assetProtocol value:NetBIOS
Attribute:assetSerialNumber value:
Attribute:assetSwRevision value:
Attribute:assetTag value:SEC_TAG2
Attribute:assetVendor value:VMware
Attribute:b310a420-78a5-11e9-a189-9ac8f4107843 value:Root
Attribute:b8e73d50-78a5-11e9-a189-9ac8f4107843 value:SEC_TAG2
Attribute:ip value:10.62.145.72
Attribute:SkipProfiling value:false

6.使用正确的数据更新情景可视性

配置

注意：即使您只希望在情景可视性中了解assetGroup和assetTag，也需要步骤1 - 3

步骤1.在ISE上配置终端自定义属性

导航至管理>身份管理>设置>终端自定义属性。根据下图配置自定义属性（assetGroup和assetTag）。

步骤2.使用自定义属性配置分析器策略

导航至工作中心>分析器>分析策略。单击“Add”。配置分析器策略，类似于下图。

步骤3.为分析实施启用自定义属性

导航至工作中心>分析器>设置>分析器设置。确保 为分析实施启用自定义属性 复选框。

步骤4.导出IND身份证书

导航至“设置”> pxGrid。单击“Download .pem IND certificate(下载.pem IND证书)”。此证书在pxGrid注册期间使用，因此ISE应信任它。

步骤5.将IND身份证书上传到ISE受信任存储

导航到管理>证书>证书管理>受信任证书。单击“Import”。单击“浏览”，然后从步骤3中选择IND证书。单击“提交”。

步骤6.为IND生成证书

IND不使用ISE CA颁发的客户端证书。相反，目标是填充IND受信任存储，因此当ISE发送其pxGrid证书（在TLS交换期间）时，IND会信任它。

导航至Administration > pxGrid Services > Certificates。根据下图填充字段。CN字段是必填项，因为ISE CA的目标是颁发身份证书。理想情况下，您应输入IND的FQDN，但由于IND未使用身份证书，因此CN字段值不重要。

步骤7.下载PKCS12格式的证书链

步骤8.在IND上上传证书链

导航至Settings > pxGrid > Trusted Certificates。单击“New(新建)”。输入名称（链将在IND上以此名称显示）。 密码是步骤1中的密码。

步骤9.在IND上配置策略服务器

导航至设置>策略服务器，单击新建。输入ISE pxGrid节点的ISE FQDN和IP地址。

步骤10.在IND上配置pxGrid集成

导航至Settings > pxGrid并启用pxGrid集成。单击切换按钮。输入节点名称，此主机名是ISE上pxGrid客户端的名称。从Server 1字段的下拉菜单中选择之前配置的ISE。单击“Register(注册)”。

注意：如果ISE上启用了Automatically approve new certificate-based accounts设置，则步骤11 - 12可能会被忽略。

成功注册后，IND上会显示以下消息：

步骤11.批准ISE上的IND

导航至“管理”>“pxGrid服务”>“所有客户端”。打开“待审批总额(1)”下拉菜单。单击“全部批准”。

步骤12.在IND上激活pxGrid服务

导航至“设置”> pxGrid。单击“激活”。

成功激活后，IND上显示以下消息：

验证

ISE验证

导航至“管理”>“pxGrid服务”>“所有客户端”。在“所有客户端”中，IND使用pxGrid版本2,IND客户端应显示为脱机(XMPP)。

单击Web客户端，确认IND客户端的状态为ON，并且/topic/com.cisco.endint.asset是订用的一部分。

IND验证

IND应转换到In Sync（正在同步）状态。如果ISE上的批量下载成功，如果不是IND将停滞在Out of Sync（不同步）状态，则完成此操作。

故障排除

IND上同步状态停滞在不同步状态

如果ISE上的批量下载成功，则会发生从不同步到不同步的转换。下面是IND application.log。

2019-05-22 22:09:06,902:INFO:qtp281049997-53444:PxgridConfigMgr:: Pxgrid Statistics Start:: Bulk Request : bulkReqAssetCount:2 add: false
2019-05-22 22:09:06,902:INFO:qtp281049997-53444:PxgridConfigMgr:: Pxgrid Statistics updated:: Bulk Request : AssetCount:2
2019-05-22 22:09:06,902:INFO:qtp281049997-53444:PxgridConfigMgr:: Sync Status transition to IN_SYNC
2019-05-22 22:09:06,918:INFO:qtp281049997-53444:PxGridServiceRestController:: getAssets Completed

ISE必须能够解析由IND共享的IND主机名。否则，ISE无法批量下载，IND将永远不会转换到In Sync状态。如果批量下载失败（WIN2012-AAA无法由ISE解析），您可以在profiler.log中看到以下异常。 要触发批量下载，可取消选中并检查PSN上的pxGrid探测功能。

2019-04-30 13:59:50,708 INFO [ProfilerINDSubscriberPoller-60-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- New services are: []
2019-04-30 13:59:50,714 INFO [ProfilerINDSubscriberPoller-60-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- NODENAME:ind
2019-04-30 13:59:50,714 INFO [ProfilerINDSubscriberPoller-60-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- REQUEST BODY{"offset":"0","limit":"500"}
2019-04-30 13:59:50,716 ERROR [ProfilerINDSubscriberPoller-60-thread-1][] cisco.profiler.infrastructure.probemgr.INDSubscriber -::- Unable to get sync statusWIN2012-AAA:WIN2012-AAA
java.net.UnknownHostException: WIN2012-AAA
at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
at java.net.Socket.connect(Socket.java:589)
at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:673)
at sun.security.ssl.BaseSSLSocketImpl.connect(BaseSSLSocketImpl.java:173)
at sun.net.NetworkClient.doConnect(NetworkClient.java:180)
at sun.net.www.http.HttpClient.openServer(HttpClient.java:463)
at sun.net.www.http.HttpClient.openServer(HttpClient.java:558)
at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:264)
at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1156)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1050)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1334)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1309)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:259)
at com.cisco.profiler.infrastructure.probemgr.INDSubscriber.getRequest(INDSubscriber.java:362)
at com.cisco.profiler.infrastructure.probemgr.INDSubscriber.isInSync(INDSubscriber.java:500)
at com.cisco.profiler.infrastructure.probemgr.INDSubscriber.populateIOTServiceList(INDSubscriber.java:462)
at com.cisco.profiler.infrastructure.probemgr.INDSubscriber$WorkerThread.run(INDSubscriber.java:441)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)

并非所有终端都与ISE共享

只有pxGrid资产标志为“是”(Yes)时，IND上的终端才与ISE共享，MAC地址也应可用，否则ISE没有足够的数据来创建终端。

assetTag和AssetGroup在ISE上不可用

如果assetTag仅不可用，则在使用错误的TAG类型时可能会出现这种情况。更新终端时，需要使用安全标记（而非常规标记）。

如果AssetTag和AssetGroup都不可用，则可能有多种原因

1.未使用自定义属性配置分析策略（请参阅文档配置部分的步骤1-3）

2.因CSCvn66106缺陷 端点属性过滤器： 应禁用。否则，它会从分类器过滤自定义属性。在profiler.log中可以看到以下日志。

 2019-05-22 11:20:11,796 DEBUG [PersistentWorker-8-18-thread-1][] com.cisco.profiler.im.EndPoint -:Profiling:- filtered custom attributes are:{assetGroup=Root, assetTag=SEC_TAG2, b310a420-78a5-11e9-a189-9ac8f4107843=Root, b8e73d50-78a5-11e9-a189-9ac8f4107843=SEC_TAG2}