You can use Cisco
pxGrid to share the context-sensitive information from Cisco ISE session
directory with other network systems such as ISE Eco system partner systems and
other Cisco platforms. The pxGrid framework can also be used to exchange policy
and configuration data between nodes like sharing tags and policy objects
between Cisco ISE and third party vendors, and for other information exchanges.
pxGrid also allows 3rd party systems to invoke adaptive network control
actions (EPS) to quarantine users/devices in response to a network
or security event. The TrustSec information like tag definition, value, and
description can be passed from Cisco ISE via TrustSec topic to other networks.
The endpoint profiles with Fully Qualified Names (FQNs) can be passed from
Cisco ISE to other networks through a endpoint profile meta topic. Cisco pxGrid
also supports bulk download of tags and endpoint profiles.
You can publish and subscribe to SXP bindings (IP-SGT mappings) through pxGrid. For more information about SXP bindings,
see Security Group Tag Exchange Protocol.
In a high-availability configuration, Cisco pxGrid servers replicate information between the nodes through the PAN. When the
PAN goes down, pxGrid server stops handling the client registration and subscription. You need to manually promote the PAN
for the pxGrid server to become active.
On the Active pxGrid 1.0 node, these processes show as 'Running'. On the Standby pxGrid 1.0 node, they show as Disabled. If
the Active pxGrid 1.0 node goes down, the standby pxGrid node detects this, and starts the four pxGrid processes. Within a
few minutes, these processes show as 'Running', and the Standby node becomes the Active node. You can verify that pxGrid is
in standby on that node by running the CLI command show logging application pxgrid or show logging application pxgrid.state.
For XMPP (Extensible Messaging and Presence Protocol) clients, pxGrid nodes work in Active or Standby high availability mode
which means that the pxGrid Service is in "running" state on the active node and in "disabled" state on the standby node.
After the automatic
failover to the secondary pxGrid node is initiated, if the original primary
pxGrid node is brought back into the network, the original primary pxGrid node
will continue to have the secondary role and will not be promoted back to the
primary role unless the current primary node goes down.
At times, the original primary pxGrid node might be automatically promoted back to the primary role.
In a high
availability deployment, when the primary pxGrid node goes down, it might take
around 3 to 5 minutes to switchover to the secondary pxGrid node. It is
recommended that the client waits for the switchover to complete, before
clearing the cache data in case of primary pxGrid node failure.
The following logs are
available for pxGrid node:
pxgrid-cm.log—Updates on publisher/subscriber and data exchange
activity between client and server.
pxgrid-controller.log—Displays the details of client capabilities, groups, and
pxgrid-jabberd.log—All logs related to system state and
pxgrid-pubsub.log—Information related to publisher and