Security · ISE & pxGrid
Diagnose Cisco ISE pxGrid: subscribers stuck in pending, expired node certs, missing TrustSec SXP, broken SIEM feeds, and ASA/FTD quarantine integration.
pxGrid looks simple until a cert rolls, a subscriber goes silent, and nobody notices for a week. This tool walks the common failure modes and gives you the ISE CLI / GUI steps to fix each.
Each symptom gets a likely root cause and 3-5 ordered checks. The checks mix ISE GUI navigation, show application status ise CLI, and openssl cert validation. Follow the order — most issues resolve at step 2 or 3.
pxGrid is a pub/sub bus. Subscribers register to topics (e.g. SessionDirectory, EndpointProfileMetaData, TrustSecMetaData), and ISE pushes changes. Auth is cert-based — every subscriber presents a client cert, signed by ISE's internal CA (or an external one). Certs expire, and when they do, pxGrid goes silent without a loud error. Monitor expiry via MnT dashboard or an external monitor.
Yes — pxGrid 2.0 uses HTTPS/WebSockets instead of XMPP. ISE 2.4+ supports both. New integrations should use 2.0.
Default 3 years for internal CA; whatever your enterprise CA says if external. Set a calendar reminder 60 days before expiry.
Cert expired on pxGrid client. Solution: renew via ISE Admin GUI → Certificates → pxGrid Services → regenerate; re-export; re-import on Splunk TA-cisco-ise.
ASA uses pxGrid to tell ISE "quarantine this endpoint." If ISE pxGrid node is on a different PSN than ASA expects, sessions may not update. Fix: point ASA at the correct pxGrid FQDN and confirm DNS resolves to all ISE pxGrid nodes.