Contents

Issue

When attempting to configure Threat-Centric NAC (TC-NAC) in Cisco Identity Services Engine (ISE) with Rapid7's cloud-hosted InsightVM console, the connector test fails with a "Nexpose 302" error message displayed in the ISE GUI. This error occurs when testing or saving the Rapid7 connector configuration, preventing the TC-NAC integration from completing successfully.

Error connecting to Nexpose server, Error in connecting to Nexpose: 302

Environment

- Cisco ISE

- TC-NAC service enabled

- Rapid7 cloud-hosted InsightVM/Nexpose console

Resolution

The TC-NAC Nexpose adapter in ISE does not support Rapid7's cloud-hosted InsightVM/Nexpose console. The current adapter is designed exclusively for on-premises Rapid7 Nexpose/InsightVM Security Console deployments and cannot handle the cloud console's API architecture and redirect behavior.

Available Options

Option 1: Revert to On-Premises Console (Immediate Solution)

Use an on-premises Rapid7 Nexpose/InsightVM Security Console to restore TC-NAC functionality.

Option 2: Enhancement Request (Future Solution)

A formal enhancement request has been submitted to Cisco Development:

- Enhancement ID: CSCwv45499

- Request: Add support for Rapid7 cloud-hosted InsightVM/Nexpose console integration

Diagnostic Steps Performed

The following diagnostic analysis confirmed the compatibility limitation:

1. Analyze debug logs for va-service and va-runtime components. The logs revealed the HTTP 302 redirect behavior from the cloud console.

2. Analyze URL reconstruction. The TC-NAC adapter expects an on-premises API URL in the format:

https://:/api/1.1/xml

When configured with the cloud console hostname, the Nexpose client reconstructs the URL to:

https://<host>:<port>/api/1.1/xml

This triggers a 302 redirect that the Nexpose client code cannot handle.

3. Verify API compatibility. Engineering confirmed that the Rapid7 cloud console uses a different REST API model with JSON payloads and API-key/OAuth authentication, which differs from the XML-based API (v1.1) that the current TC-NAC adapter expects.

Cause

The TC-NAC Nexpose adapter in ISE was designed to integrate with on-premises Rapid7 Nexpose/InsightVM Security Console deployments using the legacy XML API (v1.1/v1.2). The adapter does not support:

- Rapid7's cloud-hosted console architecture

- HTTP 302 redirect handling from cloud endpoints

- The newer REST API model used by the cloud console (JSON payloads and API-key/OAuth authentication)

This is a design limitation rather than a software defect. The cloud console has never been a supported target for the current TC-NAC adapter as of July 2026.

Related Enhancement: CSCwv45499 - Request for Rapid7 cloud console support

Related Content

- Cisco Technical Support & Downloads

- [ENH] ISE support for Cloud Console with Rapid 7 Nexpose