Issue

When attempting to integrate FMC version 7.7.x with Cisco ISE using the new Quick Configuration option for pxGrid integration, the process fails during the Testing pxGrid Connection step with a 502 Proxy Error.

The integration workflow successfully completes the "Establishing Trust" phase and certificate exchange, but fails when testing the pxGrid connection. The FMC GUI displays this error message:

Integrating ISE

:exclamation_mark:Process stopped due to an error

:heavy_check_mark:Establishing Trust

Done

v ISE-CA

CA CERTIFICATE

Subject DN  CN-ISE-CA,0.9.2342.19200300.100.1.25 #130a6b616e7a6c6569736d63,0.9.2342.19200300.100.1.25=#13056c6f63616c

Issuer DN   CN=ISE-CA,0.9.2342.19200300.100.1.25 #130a6b616e7a6c6569736d63,0.9.2342.19200300.100.1.25 #13056c6f.....

> ciscoise.domain.local

:exclamation_mark:Testing pxGrid Connection

Failed

Message:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html>

<head>

<title>502 Proxy Error</title>

</head>

<body>

<h1>Proxy Error</h1>

<p>

The proxy server received an invalid response from an upstream server.<br />

The proxy server could not handle the request.

</p>

<p>

Reason: <strong>Error reading from remote server</strong>

</p>

</body>

</html>

Environment

- ISE 3.3 patch 7 and 3.4.0

- FMC 7.6.2 build 329 and FMC 7.7.0 build 91

- New deployment attempting pxGrid integration using Quick Configuration method

- Network connectivity and DNS resolution confirmed between FMC and ISE

- No external proxy configured in the environment

Resolution

The issue is resolved by using the Advanced Configuration (Old) method instead of the Quick (New) Configuration option for FMC-ISE pxGrid integration. This workaround successfully establishes the pxGrid connection and allows normal operation.

Workaround Implementation Steps

1: Access the FMC web interface and navigate to the ISE integration section.

2: Instead of using the Quick Configuration option, select the Advanced Configuration method for pxGrid integration:

3: Complete the Advanced Configuration workflow following the standard FMC-ISE integration procedures:

4: Verify the pxGrid connection is established successfully using the Advanced Configuration method:

inline_image_2.png

Troubleshooting Steps Performed

These diagnostic steps were completed to isolate the root cause:

- Verified FMC and ISE could successfully establish certificate trust

- Confirmed DNS resolution and network reachability between systems

- Verified no external proxy configuration was present

- Reviewed FMC logs and pigtail output showing internal proxy/backend errors during pxGrid test phase

- Tested integration using the legacy Advanced Configuration method, which completed successfully

Long-term Solution

To use the Quick Configuration option without encountering this issue, upgrade to Cisco Firepower version 10.0.0 or later, where this defect has been resolved.

Cause

This issue is caused by Cisco Bug ID CSCwq75449, a known software defect in FMC version 7.7.x where the Quick Configuration pxGrid integration workflow fails internally. The defect occurs even though certificate trust and basic communication with ISE succeed. The bug affects the Quick Configuration method specifically, while the Advanced Configuration method continues to function normally. This defect is resolved in Cisco Firepower version 10.0.0.

Related Content

- Setting up the pxGrid connection between ISE and FMC

- Cisco Bug CSCwq75449 - 502 Proxy Error when regenerating certificate in ISE Quick Configuration tab

- Cisco Bug CSCwq32873 - 502 Proxy Error when navigating to ISE quick configuration

- Cisco Bug CSCwq13058 - FMC Identity Source Shows Error ISE IPv6 Address not Reachable

- Cisco Bug CSCwr49233 - FMC 10.0.0 - ISE 3.4p1 Integration not working when using Quick Configuration method

- Cisco Bug CSCwp37409 - FMC reporting issues with ISE when configured with quick Configuration

- Cisco Technical Support & Downloads