通過pxGrid Cloud將雲交付的防火牆管理中心與ISE整合

簡介

本文檔介紹通過pxGrid Cloud將Cisco ISE與雲交付的防火牆管理中心(cdFMC)整合的過程。

必要條件

• 思科身份服務引擎(ISE)工作知識
• Cisco Catalyst雲門戶中的帳戶
• 思科安全雲端控制入口網站上的帳戶

需求

• 在思科ISE部署中安裝和啟用優勢許可證層。
• pxGrid雲代理建立到Cisco pxGrid雲的出站HTTPS連線。因此，如果網路使用代理訪問網際網路，請配置Cisco ISE代理設定。要在Cisco ISE中配置代理設定，請選擇管理>系統>設定>代理。
• 思科ISE受信任證書儲存必須包括驗證思科pxGrid雲提供的伺服器證書所需的根CA證書。確保為此根CA證書啟用了Trust for Authentication of Cisco Services選項。要啟用Trust for Authentication of Cisco Services，請選擇管理>系統>證書。
• 確保為從思科ISE到思科pxGrid雲門戶的出站連線開啟埠443。如果配置了防火牆或代理設定，請確保這些URL未被阻止。

https://dna.cisco.com

https://dnaservices.cisco.com

https://ciscodnacloud.com

採用元件

ISE軟體版本：3.4修補程式1、4節點部署（PAN、SAN和2個PSN，並啟用pxGrid服務）

cdFMC版本：20241127

適用於VMware版本的Cisco Firepower威脅防禦(FTD):7.2.5

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

Cisco pxGrid雲術語

以下是Cisco pxGrid雲解決方案中使用的一些常用術語及其在Cisco pxGrid雲環境中的含義：

• 產品：將一組功能打包在一起並作為解決方案提供
• 訂閱：租戶使用的優惠的一個例項是訂閱
• 應用：您可以根據自己的要求為產品建立和註冊應用程式。

背景資訊

Cisco ISE提供多個安全供應商之間的情景共用；但是，當前架構不允許本地ISE和基於雲的解決方案之間通過網路邊界進行通訊，而無需在防火牆中留下某種旁路/漏洞。 

思科ISE的pxCloud是基於雲的解決方案，可解決此問題，並在本地和雲之間實現情景共用，無需額外的安裝、額外開銷和影響網路安全性。它安全且可自定義，使您能夠僅共用想要共用的資料，且僅使用與您的應用程式相關的情景資料。 

Cisco ISE版本3.1補丁3及更高版本支援pxGrid Cloud。思科及其合作夥伴可以開發基於pxGrid雲的應用，並使用pxGrid雲產品註冊這些應用。思科依靠cisco DNA-Cloud Portal進行載入和註冊應用，無需依賴其他內部部署基礎設施。這些應用使用外部RESTful服務(ERS)、開放式API和pxGrid（API和websocket）與思科ISE交換資訊，以使用cdFMC中ISE的訂閱和使用者資料。

設定

網路圖表

通過pxGrid Cloud整合cdFMC和ISE

組態

涉及四個主要步驟：

• 在ISE中匯入Cisco pxGrid雲伺服器證書。
• 向Catalyst雲門戶註冊ISE。
• 使用整合目錄在ISE上啟用cdFMC應用程式
• 建立pxGrid應用程式(cdFMC)例項

在ISE中匯入Cisco pxGrid雲伺服器證書

ISE必須與Cisco pxGrid雲建立信任。即使雲網站使用公開簽名的證書進行身份驗證，ISE也不會維護受信任的根CA的完整清單。因此管理員必須建立信任關係。通過瀏覽到Catalyst雲門戶匯出pxGrid雲根證書和中間證書。大多數瀏覽器都允許這樣做。以下是從Chrome瀏覽器獲取證書的步驟。 

檢視站點資訊

匯出證書鏈

如果證書鏈缺失，請將證書匯入ISE中的「受信任證書」儲存（ISE已具有IdenTrust商業根CA 1）。 

確保為此根CA證書啟用「Trust for Authentication of Cisco Services」選項。要啟用Trust for Authentication of Cisco Services，請選擇管理>系統>證書。

為思科服務的身份驗證啟用信任

流程圖

應用啟用工作流

在此設定中使用的ISE部署

向Catalyst雲門戶註冊ISE

在思科ISE中啟用pxGrid雲服務並註冊您的裝置。

1.在Cisco ISE GUI中，選擇Administration > System > Deployment。

2.按一下要在其上啟用pxGrid雲服務的節點（在本例中是第一個PSN節點）。

3.在General Settings頁籤中，啟用pxGrid服務。

4.選中pxGrid Cloud覈取方塊。

附註：pxGrid雲服務只能在兩個節點上啟用，以實現高可用性。僅當在該節點上啟用pxGrid服務時，才能啟用pxGrid雲選項。

5.在ISE部署名稱欄位中，輸入有意義的名稱。此名稱顯示在Catalyst雲門戶中，可用於區分是否向雲註冊多個ISE部署。您可以使用ISE部署名稱驗證在Cisco Catalyst雲門戶上註冊的思科ISE部署。

（可選）在Description（可選）欄位中，輸入您的思科ISE部署的描述。

6.在Region下拉選單中，選擇一個區域以註冊您的Cisco ISE裝置。除了美國，Cisco pxGrid Cloud現在還在歐洲、亞太地區和日本得到支援。請注意，要與pxGrid Cloud一起使用的應用程式也必須在同一區域中可用。

7.按一下註冊。

向pxGrid雲註冊ISE PSN

8.在「啟用設備」彈出頁面中，將自動填寫裝置的啟用碼。按「Next」（下一步）。

啟用裝置

裝置已啟用

附註：如果在第二個節點上啟用「pxGrid雲」角色，ISE不需要所有這些詳細資訊，因為ISE與pxGrid雲的註冊處於部署級別。

9.使用您的登入憑證登入Cisco Catalyst雲門戶帳戶。如果您沒有登入憑證，請建立一個新帳戶以完成裝置註冊。如需詳細資訊，請參閱在Cisco Catalyst雲入口上建立帳戶

您的Cisco ISE裝置已啟用並註冊。

向Catalyst雲門戶註冊的ISE節點

10.您可以在pxGrid部分(管理>系統>部署> pxGrid)中查詢已註冊思科ISE的詳細信息。

驗證向pxGrid Cloud註冊的ISE

您可以點選Deregister取消註冊您的Cisco ISE裝置。註銷思科ISE也會自動停用已連線的應用。

使用整合目錄在ISE上啟用cdFMC應用程式

1.在ISE GUI中，選擇Administration > Integration Catalog。

2.在Available integrations下，選擇Firewall Management Center 應用程式。

附註：應用程式清單取決於帳戶。某些應用程式可能只暴露給特定帳戶。

整合目錄

3.在App configuration部分，選擇New instance，然後為你的應用程式配置選擇Data scope。至少選擇一個資料範圍以繼續。

附註：選擇資料範圍時，它也會在系統級別pxGrid雲策略設定下啟用該範圍。

4.按一下啟用以啟用應用。

ISE上的FMC應用配置

5.從一次性密碼(OTP)彈出視窗中，複製OTP以在建立pxGrid應用程式例項時在cdFMC上兌換它

適用於cdFMC應用程式的OTP

6.導航到管理> pxgrid服務>客戶端管理> pxGrid雲策略，配置pxGrid雲策略。選擇您要與Saas應用程式共用的pxGrid服務，並啟用External RESTful Services(ERS)API和OpenAPI對Cisco pxGrid雲應用的只讀訪問。

配置pxGrid雲策略

附註：Echo服務用於運行運行狀況檢查以確定與ISE的pub-sub和API連線。

         預設情況下，Cisco pxGrid雲應用程式被授予對API的只讀訪問許可權（只能執行HTTP GET操作）。 如果您還希望允許POST、PUT和DELETE操作，請在pxGrid Cloud Policy視窗中啟用Read/Write選項。

建立pxGrid應用程式(cdFMC)例項 

1.以具有超級管理員角色的使用者身份登入安全雲控制(SCC)門戶。

SCC登入頁

2.在「安全雲控制」選單中，按一下管理> 整合> 防火牆管理中心，然後選擇您的cdFMC例項，並在右窗格選項中選擇System > Configuration。

導航到防火牆管理中心

3.在「配置」頁上，選擇整合>其他整合>身份源>選擇服務型別身份服務引擎(pxGrid Cloud)。 點選建立pxGrid應用例項並兌換從思科ISE複製的OTP以新增例項。

建立cdFMC應用程式例項

4.在Cisco Catalyst雲門戶上驗證它，位於Applications and Products > Firewall Management Center > Manage > Products > Select Instance下拉選單。 

驗證Catalyst雲門戶上的cdFMC

5.選擇新建立的cdFMC應用程式，然後按一下Add。選擇Region，然後按一下Activate。  

選擇區域

5.選擇應用程式例項，然後按一下下一步。選擇您的產品（ISE pxGrid節點），按一下下一步。

6. 配置訪問控制：選擇所選ISE產品上cdFMC允許的功能功能。按「Next」（下一步）。此時將顯示配置摘要。驗證並按一下Activate。

為cdFMC配置訪問控制

產品ISE連線到cfFMC

8.在Cisco Catalyst雲門戶上驗證該配置，其位置為Applications and Products > Firewall Management Center > Manage > Products > Select Instance下拉選單。 

驗證應用是否已啟用

驗證

1.  在Catalyst雲入口上，導航至應用和產品。選擇您的ISE產品名稱並檢查產品詳細資訊。驗證「Activated Application（啟用的應用程式）」下是否顯示cdFMC。

在Catalyst雲端控制入口上驗證

2.  在安全雲控制上，測試配置的cdFMC應用程式例項。測試顯示「成功」

在安全雲控制門戶上驗證

3.使用show application status ise命令登入到Active pxGrid節點，並驗證Hermes（pxGrid雲代理）是否處於運行狀態。此代理在Standby pxGrid節點上處於禁用狀態。

驗證Hermes（pxGrid雲代理）狀態

在兩個pxGrid節點上檢查pxcloud.log以確認Active和Standby Status:

On Active pxGrid node (pxcloud.log)

2025-03-17 14:35:25,530 DEBUG  [pxCloud-hermesCheck-2768][[]] cpm.pxcloud.ha.statemachine.StateMachine -:::::- RUNNING (HERMES_OK) ------> RUNNING
2025-03-17 14:35:27,438 DEBUG  [pxCloud-heartbeat-2769][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- url - https://ise341-psn2.poongarg.local:8910/pxgrid/pxcloud/statusLookup
2025-03-17 14:35:27,445 DEBUG  [pxCloud-heartbeat-2769][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- HeartBeat response from peer - StatusResponse [role=STANDBY, state=MONITORING, pxGridConnectionStatus=NOT_CONNECTED, cloudConnectionStatus=NOT_CONNECTED, reason=] 
2025-03-17 14:35:27,445 DEBUG  [pxCloud-heartbeat-2769][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- Post PEER_MONITORING to state machine
2025-03-17 14:35:27,445 DEBUG  [pxCloud-heartbeat-2769][[]] cpm.pxcloud.ha.statemachine.StateMachine -:::::- RUNNING (PEER_MONITORING) 
2025-03-17 14:35:35,548 DEBUG  [pxCloud-hermesCheck-2768][[]] cpm.pxcloud.ha.statemachine.HermesCheck -:::::- Sending request to Hermes: POST https://localhost:8913/hermes/cloudConnectionStatus
2025-03-17 14:35:35,572 DEBUG  [pxCloud-hermesCheck-2768][[]] cpm.pxcloud.ha.statemachine.HermesCheck -:::::- Hermes response: 200 OK
2025-03-17 14:35:35,572 DEBUG  [pxCloud-hermesCheck-2768][[]] cpm.pxcloud.ha.statemachine.HermesCheck -:::::- Status - HermesConnectionStatus [pxGridConnectionStatus=CONNECTED, cloudConnectionStatus=CONNECTED, reason=] 

On Standby pxGrid node (pxcloud.log)

2025-03-17 14:34:14,145 DEBUG  [pxCloud-heartbeat-6441][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- url - https://ise341-psn1.poongarg.local:8910/pxgrid/pxcloud/statusLookup
2025-03-17 14:34:14,153 DEBUG  [pxCloud-heartbeat-6441][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- HeartBeat response from peer - StatusResponse [role=ACTIVE, state=RUNNING, pxGridConnectionStatus=CONNECTED, cloudConnectionStatus=CONNECTED, reason=]
2025-03-17 14:34:14,154 DEBUG  [pxCloud-heartbeat-6441][[]] cpm.pxcloud.ha.statemachine.HeartBeat -:::::- Post PEER_RUNNING to state machine
2025-03-17 14:34:14,154 DEBUG  [pxCloud-heartbeat-6441][[]] cpm.pxcloud.ha.statemachine.StateMachine -:::::- MONITORING (PEER_RUNNING)

此外，檢查埠8913，該埠僅在ACTIVE pxGrid節點上開啟：

ise341-psn1/admin#show ports | include 8913                                     
           tcp: 127.0.0.1:8913
ise341-psn1/admin# 

4.導航到管理> pxGrid服務>客戶端管理>客戶端> pxGrid雲客戶端，以驗證pxGrid雲客戶端。同時檢查預訂的主題。

ise上的PXgrid雲客戶端

5.驗證訂閱的主題是否在cdFMC上獲取。在安全雲控制門戶上，按一下策略> 威脅防禦> 整合> 其他整合> 身份源。按一下身份服務引擎(pxGrid Cloud)。按一下配置過濾器。在該頁上，按一下動態屬性篩選器頁籤。建立動態屬性篩選器。

從ISE獲取屬性

疑難排解

1. ISE註冊過程中失敗：

缺少代理配置

檢查Internet連線以及可能的代理配置錯誤。

2.  啟用pxGrid雲服務並配置名稱和區域引數後，pxGrid狀態在ISE編輯節點頁上顯示Not connected。

在要啟用pxGrid雲服務的節點上檢查hermes.log:

ise341-psn1/admin#show logging application hermes/hermes.log | begin 8913
2025-03-17T09:19:35.277Z | INFO | hermes/httpserver.go:57 | Starting REST server on :8913
2025-03-17T09:19:35.285Z | INFO | hermes/httpserver.go:78 | REST server is up and running
2025-03-17T09:19:35.307Z | ERROR | hermes/pxgrid.go:194 | Failed to establish pxGrid WebSocket connection: pubsub service lookup failed: service lookup for pubsub service failed: Post "https://ise341-psn1.poongarg.local:8910/pxgrid/control/ServiceLookup": SSL errors: SSL routines:tls_process_server_certificate:certificate verify failed
2025-03-17T09:19:35.307Z | ERROR | hermes/main.go:166 | Failed to open pxGrid WebSocket connection: Failed to establish pxGrid WebSocket connection: pubsub service lookup failed: service lookup for pubsub service failed: Post "https://ise341-psn1.poongarg.local:8910/pxgrid/control/ServiceLookup": SSL errors: SSL routines:tls_process_server_certificate:certificate verify failed
2025-03-17T09:19:35.307Z | INFO | hermes/config.go:279 | Stopping monitoring of configuration file: /opt/hermes/config.yaml
2025-03-17T09:19:35.307Z | INFO | hermes/connectionstatus.go:81 | Resetting connection status to DISCONNECTED with reason 'Failed to establish pxGrid WebSocket connection: pubsub service lookup failed: service lookup for pubsub service failed: Post "https://ise341-psn1.poongarg.local:8910/pxgrid/control/ServiceLookup": SSL errors: SSL routines:tls_process_server_certificate:certificate verify failed'
2025-03-17T09:19:35.308Z | ERROR | hermes/main.go:402 | Error running Hermes: Failed to establish pxGrid WebSocket connection: pubsub service lookup failed: service lookup for pubsub service failed: Post "https://ise341-psn1.poongarg.local:8910/pxgrid/control/ServiceLookup": SSL errors: SSL routines:tls_process_server_certificate:certificate verify failed
2025-03-17T09:19:35.308Z | INFO | hermes/httpserver.go:90 | Stopping REST server on :8913

Hermes Rest伺服器偵聽埠8913。日誌清楚地顯示Hermes REST伺服器正在嘗試啟動，但由於證書驗證失敗，未能建立pxGrid WebSocket連線。

解決方案：驗證pxGrid證書是否有效，並且證書鏈是否未中斷。檢視憑證並驗證憑證狀態是否良好。在這種情況下，向此節點頒發的pxGrid證書中的ISE主機名不正確。

有效的pxGrid證書

3.catalyst雲門戶上的cdFMC應用程式啟用失敗。

解決方案：確保在ISE上，在pxGrid雲策略下，啟用外部RESTful服務(ERS)API和OpenAPI只讀訪問。

與pxGrid雲功能相關的日誌：

附註：無論您在哪個節點上啟用pxGrid雲角色，都需要檢查活動PAN節點上的日誌。裝置註冊後，Hermes日誌位於啟用該裝置的特定節點上。

         Hermes.log僅支援Debug、Info、Warn和Error日誌級別。因此，如果選擇「Trace」，日誌級別將設定為Debug for hermes.log。如果選擇Fatal，則對於hermes.log，日誌級別設定為Error。

ISE註冊/註冊和應用。啟用流程

在註冊裝置之前，ISE使用裝置令牌從雲獲取區域清單和應用清單。此令牌由ISE的「遙測」元件提供。檢查PAN節點上的sch.log:

2025-03-17 09:10:23,361 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.DNATelemetryClient -:::::- Telemetry Lifecycle configured : PRODUCTION
2025-03-17 09:10:23,361 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.DNATelemetryClient -:::::- Telemetry lifecycle::PRODUCTION
2025-03-17 09:10:23,463 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.TetheringStateStorageImpl -:::::- Read tethering state from the db...
2025-03-17 09:10:23,467 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.TetheringStateStorageImpl -:::::- Get encryption key for the tethering state data...
2025-03-17 09:10:23,480 INFO [openapi-http-pool7][[]] cisco.dna.tethering.client.TetheringClient -:::::- DNA Cloud Tethering Client Initialized, member ID = 67d7c58488c5fd08d085fffd, enrollment = existing
2025-03-17 09:10:23,480 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.DNATelemetryClient -:::::- Tethering Client Initialized successfully
2025-03-17 09:10:23,483 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.DNATetheringClient -:::::- Initialization Details :- Member Id: 67d7c58488c5fd08d085fffd
2025-03-17 09:10:24,492 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.TetheringStateStorageImpl -:::::- Get encryption key for the tethering state data...
2025-03-17 09:10:24,497 INFO [openapi-http-pool7][[]] infrastructure.telemetry.sch.api.TetheringStateStorageImpl -:::::- Write tethering state to the db...
2025-03-17 09:10:24,529 INFO [openapi-http-pool7][[]] cpm.infrastructure.telemetry.api.TelemetryConfigHandler -:::::- Updated Tethering State in the TelemetryConfig table

pxcloud.log（PAN節點），一旦啟用pxGrid雲服務，Hermes（pxGrid雲代理）就會被啟用，ISE獲取區域資訊並通過遙測元件接收令牌。

2025-03-17 08:47:00,300 INFO [main][[]] cisco.cpm.pxcloud.api.PxCloudInitializer -:::::- Initializing pxGrid Cloud
2025-03-17 08:47:00,312 INFO [main][[]] cisco.cpm.pxcloud.pxgrid.PxCloudProviderRegistration -:::::- Registering the pxCloud service into pxGrid
2025-03-17 08:47:00,314 INFO [main][[]] cisco.cpm.pxcloud.hermes.ProxyConfigNotificationHandler -:::::- Register pxCloud ProxyConfig notification handler
2025-03-17 08:47:00,376 INFO [main][[]] cisco.cpm.pxcloud.hermes.HermesConfigManager -:::::- Registering listener for Hermes cert file changes
2025-03-17 08:47:00,376 INFO [main][[]] cisco.cpm.pxcloud.hermes.HermesConfigManager -:::::- Registering listener for pxCloud log level changes
2025-03-17 08:50:18,842 INFO [main][[]] cisco.cpm.pxcloud.hermes.HermesConfigManager -:::::- Updating Hermes certificate files
2025-03-17 08:52:46,834 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 08:55:46,877 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 08:58:46,781 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:01:46,781 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:03:37,136 INFO [pool-225-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:04:46,781 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:06:37,136 INFO [pool-225-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:07:46,781 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:09:11,901 DEBUG [hermes-change-monitor-0][[]] cisco.cpm.pxcloud.hermes.PxCloudNodeChangeHandler -:::::- Periodic check of PPAN hostFQDN: ise341-PAN.poongarg.local
2025-03-17 09:09:37,136 INFO [pool-225-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:09:37,139 DEBUG [pool-225-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- ISE enrollment status is 
2025-03-17 09:10:22,475 TRACE [openapi-http-pool4][[]] cpm.iseopenapi.pxcloud.impl.PxGridApiDelegateImpl -:::::- Request to get device information.
2025-03-17 09:10:22,485 INFO [openapi-http-pool4][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- Fetching Device Info...
2025-03-17 09:10:22,739 TRACE [openapi-http-pool7][[]] cpm.iseopenapi.pxcloud.impl.PxGridApiDelegateImpl -:::::- Request to get regions is received
2025-03-17 09:10:22,750 INFO [openapi-http-pool7][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getRegionList :: get regions list api invoked.
2025-03-17 09:10:22,754 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getRegionList :: fetch device token.
2025-03-17 09:10:24,529 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getRegionList :: fetched device token.
2025-03-17 09:10:24,537 INFO [openapi-http-pool7][[]] cisco.cpm.pxcloud.utils.PxCloudHttpClient -:::::- Proxy configured. Address=x.x.x.x Port=80
2025-03-17 09:10:26,938 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getRegionList :: Retrieved region list response from cloud : HttpResponseProxy{HTTP/1.1 200 OK [Date: Mon, 17 Mar 2025 09:10:28 GMT, Content-Type: application/json; charset=utf-8, Content-Length: 452, Connection: keep-alive, X-Tracking-Id: da111708f760551999f8cdfb2bfcc6bb, vary: Origin, Access-Control-Allow-Credentials: true, Access-Control-Expose-Headers: X-Auth-Token, Via: api-gateway,upstream, Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'self'; block-all-mixed-content] ResponseEntityProxy{[Content-Type: application/json; charset=utf-8,Content-Length: 452,Chunked: false]}}
2025-03-17 09:10:26,946 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getFilteredRegionInfo :: region list before filtering based on application list : [class Region {
id: ap-southeast-1
name: ap-southeast-1
fqdn: neoffers-sg.cisco.com
}, class Region {
id: eu-central-1
name: eu-central-1
fqdn: neoffers-de.cisco.com
}, class Region {
id: us-west-2
name: us-west-2
fqdn: neoffers.cisco.com
}]
2025-03-17 09:10:26,968 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- Inside getApplicationCatalog
2025-03-17 09:10:27,051 INFO [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- URL to get apps from cloud: https://dnaservices.cisco.com/api/uno/v1/assembler/data/applications
2025-03-17 09:10:27,055 DEBUG [openapi-http-pool7][[]] cisco.cpm.pxcloud.utils.PxCloudUtils -:::::- Anonymous token is used
2025-03-17 09:10:27,533 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- Token is present
2025-03-17 09:10:27,533 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- Request to getCatalogsUsingAnonymousToken is received
2025-03-17 09:10:27,533 DEBUG [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- Inside getCatalog method
2025-03-17 09:10:27,533 DEBUG [openapi-http-pool7][[]] cisco.cpm.pxcloud.utils.PxCloudHttpClient -:::::- Inside httpGet method
!
2025-03-17 09:10:37,338 INFO [openapi-http-pool7][[]] cpm.pxcloud.api.impl.PxcloudApplicationCatalogImpl -:::::- Application Catalog status code 200 

收到啟用連結並自動註冊和註冊。

2025-03-17 09:16:42,536 TRACE [openapi-http-pool2][[]] cpm.iseopenapi.pxcloud.impl.PxGridApiDelegateImpl -:::::- Request to get verification url is received
2025-03-17 09:16:42,537 DEBUG [openapi-http-pool2][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getVerificationUri :: Checking Preconditions.
2025-03-17 09:16:42,569 DEBUG [openapi-http-pool2][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getVerificationUri :: Preconditions check completed.
2025-03-17 09:16:42,569 DEBUG [openapi-http-pool2][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getVerificationUri :: Trying to fetch activation link from platform.
!
2025-03-17 09:16:44,729 DEBUG [openapi-http-pool2][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate DEVICE_CODE b6b4c9d0-4d07-4eb6-8d5e-b8a446f4a3eb
2025-03-17 09:16:44,735 DEBUG [openapi-http-pool2][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- getVerificationUri :: Activation link retrieval completed.
2025-03-17 09:16:45,310 TRACE [openapi-http-pool3][[]] cpm.iseopenapi.pxcloud.impl.PxGridApiDelegateImpl -:::::- Request to verify CCO login and auto register if single tenant.
2025-03-17 09:16:45,345 INFO [openapi-http-pool3][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- verifyCCOLoginAndAutoRegister:: Verify CCO login and try to auto-register if there is single tenant.
!
2025-03-17 09:16:45,538 INFO [openapi-http-pool3][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- verifyCCOLoginAndAutoRegisterWithoutTenant :: Verify CCO login to check if device is activated.
2025-03-17 09:16:45,589 DEBUG [openapi-http-pool3][[]] cisco.cpm.pxcloud.utils.PxCloudHttpClient -:::::- Inside httpPost method
2025-03-17 09:16:46,805 INFO [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- validateIfApplicationStatusChanged :: Scheduler Invoked
2025-03-17 09:16:46,816 DEBUG [pool-24-thread-1][[]] cpm.pxcloud.service.ui.IntegrationCatalogScheduler -:::::- ISE enrollment status is 
2025-03-17 09:16:47,631 DEBUG [openapi-http-pool3][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- verifyCCOLoginAndAutoRegisterWithoutTenant :: auth token info for autoregister 
!
2025-03-17 09:19:14,196 INFO [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- verifyCCOLoginAndAutoRegisterWithoutTenant :: device is activated.
2025-03-17 09:19:14,196 INFO [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- executeAutoRegister :: device is activated, going to execute auto register api.
2025-03-17 09:19:14,199 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.utils.PxCloudHttpClient -:::::- Inside httpPost method
2025-03-17 09:19:16,956 DEBUG [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- executeAutoRegister :: AutoRegister api executed successfully and response is HttpResponseProxy{HTTP/1.1 201 Created [Date: Mon, 17 Mar 2025 09:19:18 GMT, Content-Type: application/json; charset=utf-8, Content-Length: 704, Connection: keep-alive, vary: Origin, Access-Control-Allow-Credentials: true, Access-Control-Expose-Headers: X-Auth-Token, Via: api-gateway,upstream, Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'self'; block-all-mixed-content] ResponseEntityProxy{[Content-Type: application/json; charset=utf-8,Content-Length: 704,Chunked: false]}}
2025-03-17 09:19:16,964 DEBUG [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- executeAutoRegister :: AutoRegister api executed successfully and response is {"data":{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJDRE5BIiwiYXV0aFNvdXJjZSI6Imh0dHBzOi8vaWQuY2lzY28uY29tL29hdXRoMi9kZWZhdWx0IiwiYXV0aHpUeXBlIjoiREVWSUNFX1JFR0lTVFJBVElPTiIsImV4cCI6MTc0MjIwNjc1OCwiaWF0IjoxNzQyMjAzMTU4LCJpc3MiOiJkbmFzZXJ2aWNlcy5jaXNjby5jb20iLCJqdGkiOiI5NGM3Mzg4NS1iYzkxLTRmNDQtOTg0MC1kYzEwNzdmYTkyYmQiLCJwciI6InVzZXIiLCJyZWdpb25zIjpbIioiXSwicm9sZXMiOlsiVEVMLUFETUlOIl0sInNlc3Npb25JZCI6ImZjYjEyNjkwLWVhZjctNGY2OS04NzBkLWQyNDExYjE1MmE5ZiIsInRlbmFudElkIjoiZTg3YzE5NmMtYzU4Ni00MWFmLTljMjYtMmVhMWUxODExNjRlIiwidGVuYW50TmFtZSI6ImNpc2NvIiwidXNlcm5hbWUiOiJwb29uZ2FyZyJ9.jSkuMLr17Vwoi3XTQC6A0Mnu8dODXAf5JQQddmtgekSMxUcgs3GrqpYzGpjTNXdS2_0TRjcbxDe4sEppStt7jg"},"responseType":"TOKEN"}.
2025-03-17 09:19:16,964 INFO [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- executeAutoRegister :: AutoRegister api executed successfully.
2025-03-17 09:19:16,964 INFO [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- processSuccessVerification :: Received token to enroll the device.
2025-03-17 09:19:17,284 INFO [openapi-http-pool9][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- ISE enrollment response: 200 OK
2025-03-17 09:19:17,284 DEBUG [openapi-http-pool9][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- ISE enrollment, processing success response:
2025-03-17 09:19:17,306 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate CLIENT_SECRET <redacted>
2025-03-17 09:19:17,325 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate TOKEN_URL <redacted>
2025-03-17 09:19:17,342 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate FQDN neoffers.cisco.com
2025-03-17 09:19:17,369 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate ENROLLMENT_STATUS true
2025-03-17 09:19:17,394 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate CLIENT_ID 1466211b-8cc1-4838-a76b-d11057eb0a4a
2025-03-17 09:19:17,418 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate TENANT_NAME cisco
2025-03-17 09:19:17,438 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate MEMBER_ID 67d7e91688c5fd08d0860039
2025-03-17 09:19:17,463 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate USERNAME <redacted>
2025-03-17 09:19:17,485 DEBUG [openapi-http-pool9][[]] cisco.cpm.pxcloud.api.PxCloudPropertiesNotificationHandler -:::::- onCreate TENANT_ID e87c196c-c586-41af-9c26-2ea1e181164e
2025-03-17 09:19:17,489 INFO [openapi-http-pool9][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- ISE Device enrollment properties data is saved to DB
2025-03-17 09:19:17,495 INFO [openapi-http-pool9][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- ISE enrollment with cloud is successful and status is set to true
2025-03-17 09:19:17,500 INFO [openapi-http-pool9][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- Initiated the cloud configuration process
2025-03-17 09:19:17,500 INFO [openapi-http-pool9][[]] cpm.pxcloud.api.impl.DeviceRegistrationApiImpl -:::::- processSuccessVerification :: device is enrolled successfully.
2025-03-17 09:19:17,554 INFO [openapi-http-pool9][[]] cpm.iseopenapi.pxcloud.util.PxGridCloudUtil -:::::- updatePxGridCloud :: pxg added. preparing to retrieve pxg wallet cert
2025-03-17 09:19:17,554 DEBUG [openapi-http-pool9][[]] cpm.iseopenapi.pxcloud.util.PxGridCloudUtil -:::::- Preparing to save HostConfig [hostName=ise341-psn1, dispayName=ise341-psn1, hostId=07374a40-0301-11f0-873b-765072d6d75e, gateWay=10.106.39.1, masterStatus=NONE, nodeRoleStatus=SECONDARY, nodeTypes=PDP+PXG+PXCLOUD, nodeServiceType=SESSION,PROFILER, userName=null, smtpPort=null, smtpHost=null, hostAlias=ise341-psn1.poongarg.local, udiPid=ISE-VM-K9, udiVid=V01, udiSN=IHJDFEDEIKM, udiPT=VM, installType=null, vmInfo=28481208|12|LARGE||2025-03-14 17:45:14 UTC|0 MB|0 MHz|4294967295 MB|5000 MHz, isApiNode=false]
2025-03-17 09:19:18,501 INFO [pxcloud-configuration-1243][[]] cpm.pxcloud.service.ui.CloudConfigurationProcessor -:::::- Enrollment complete, starting cloud configuration process now
2025-03-17 09:19:18,505 DEBUG [pxcloud-configuration-1243][[]] cpm.pxcloud.service.ui.CloudConfigurationProcessor -:::::- Starting to process the cloud configuration for ISE

pxGrid節點承擔了ACTIVE角色，但此處我們將pxGridConnectionStatus觀察為NOT_CONNECTED，該狀態在新增此pxGrid節點上的正確pxGrid證書（具有完整的根CA鏈）後得到修復

2025-03-17 09:20:12,301 TRACE [openapi-http-pool8][[]] cpm.iseopenapi.pxcloud.impl.PxGridApiDelegateImpl -:::::- Request to get device information.
2025-03-17 09:20:12,301 INFO [openapi-http-pool8][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- Fetching Device Info...
2025-03-17 09:20:12,310 INFO [Thread-150][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- Get pxCloud status information from ise341-psn1.poongarg.local
2025-03-17 09:20:12,311 INFO [Thread-150][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- pxCloud statusLookup URL: https://ise341-psn1.poongarg.local:8910/pxgrid/pxcloud/statusLookup
2025-03-17 09:20:12,427 INFO [Thread-150][[]] cpm.pxcloud.service.ui.IseEnrollment -:::::- Received response from ise341-psn1.poongarg.local: StatusResponse [role=ACTIVE, state=HERMES_ERROR, pxGridConnectionStatus=NOT_CONNECTED, cloudConnectionStatus=NOT_CONNECTED, reason=]

現在檢查ACTIVE pxGrid節點上的Hermes.log以檢視pubsub事件：

2025-03-17T09:37:43.906Z | INFO | hermes/config.go:332 | configMgr created successfully: configMgr[path=/opt/hermes/config.yaml]
2025-03-17T09:37:43.907Z | INFO | hermes/config.go:117 | Parsing configuration file: /opt/hermes/config.yaml
2025-03-17T09:37:43.907Z | INFO | hermes/config.go:338 | Config file /opt/hermes/config.yaml parsed successfully: &{PxGrid:{ClientName:~ise-hermes-ise341-psn1.poongarg.local Host:ise341-psn1.poongarg.local Port:8910 CertFile:/opt/xgrid/conf/ise-latest/host_H1742204190264.pem KeyFile:/opt/xgrid/conf/ise-latest/key_H1742204258381.pem CertPassword:aR8LRo9ZUmHnh5au3Gv7NX6VXn58SxehhxFtz2y2FL59PNfWWK9Lt/r+txTeQryR RootFile:/opt/xgrid/conf/ise-latest/ca_H1742204257774.pem} Log:{Level:info Files:[/opt/hermes/logs/hermes.log] Encoding:console} ERS:{Hostname:ise341-PAN.poongarg.local Port:-1 Enabled:false Username: CertFile:/opt/hermes/certs/adminCertFile.pem ConsumerKey: ConsumerSecret:} Proxy:{Host:bgl11-lab-wsa-1.cisco.com Port:80 Username: Password: BypassHosts:} Cloud:{CertFile:/opt/xgrid/conf/ise-latest/cacs_H1742198418638.pem} OpenAPI:{Hostname: Port:-1 Enabled:false Username: Password: CertFile:}}
2025-03-17T09:37:43.907Z | INFO | hermes/main.go:126 | Configuration loaded successfully
2025-03-17T09:37:43.908Z | INFO | trust/trust.go:28 | Custom trust bundle has been set/updated
2025-03-17T09:37:43.908Z | INFO | hermes/pxgrid.go:187 | Creating pxGrid WebSocket connection
2025-03-17T09:37:43.908Z | INFO | hermes/httpserver.go:57 | Starting REST server on :8913
2025-03-17T09:37:43.921Z | INFO | hermes/httpserver.go:78 | REST server is up and running
2025-03-17T09:37:43.983Z | INFO | pxgrid/websocket.go:93 | Got WS URL: wss://ise341-psn1.poongarg.local:8910/pxgrid/ise/pubsub
2025-03-17T09:37:44.066Z | INFO | pxgrid/websocket.go:107 | Connection to wss://ise341-psn1.poongarg.local:8910/pxgrid/ise/pubsub was created successfully
2025-03-17T09:37:44.066Z | INFO | hermes/connectionstatus.go:44 | Setting pxGrid connection status to CONNECTED

已驗證Catalyst雲門戶的根CA鏈。

2025-03-17T09:37:44.731Z | INFO | hermes/pxgrid.go:267 | Cloud credentials are obtained from ISE
2025-03-17T09:37:45.034Z | INFO | hermes/pxgrid.go:376 | DeviceID: 67d7e91688c5fd08d0860039, TenantID: e87c196c-c586-41af-9c26-2ea1e181164e
2025-03-17T09:37:45.743Z | INFO | rest/ocsp.go:207 | Making OCSP request at http://commercial.ocsp.identrust.com with timeout of 1500000000
2025-03-17T09:37:45.743Z | INFO | rest/ocsp.go:207 | Making OCSP request at http://commercial.ocsp.identrust.com with timeout of 1500000000
2025-03-17T09:37:46.273Z | INFO | rest/ocsp.go:254 | OCSP Validation passed for CN=HydrantID Server CA O1,OU=HydrantID Trusted Certificate Service,O=IdenTrust,C=US
2025-03-17T09:37:46.279Z | INFO | rest/ocsp.go:254 | OCSP Validation passed for CN=dnaservices.cisco.com,O=Cisco Systems Inc.,L=San Jose,ST=California,C=US
2025-03-17T09:37:47.054Z | INFO | rest/ocsp.go:207 | Making OCSP request at http://commercial.ocsp.identrust.com with timeout of 9000000000
2025-03-17T09:37:47.432Z | INFO | hermes/config.go:262 | File /opt/hermes/config.yaml modified. Event: WRITE
2025-03-17T09:37:47.533Z | INFO | hermes/config.go:117 | Parsing configuration file: /opt/hermes/config.yaml
2025-03-17T09:37:47.533Z | INFO | hermes/config.go:305 | New configuration loaded
2025-03-17T09:37:47.533Z | INFO | hermes/config.go:314 | Restarting Hermes due to configuration change

特定主題訂閱請求建立一次，FMC應用程式在Integration Catalog下配置：

2025-03-17T12:54:09.975Z | INFO | pxgrid/subscriber.go:40 | Request to create new subscriber: service=com.cisco.ise.session , topicKey=groupTopic and topicFQN=/topic/com.cisco.ise.session.group
2025-03-17T12:54:09.975Z | INFO | pxgrid/subscriber.go:55 | Subscriber[service: com.cisco.ise.session, topic: groupTopic, id: cvc1msd3ct8r98jaf6dg] created successfully
2025-03-17T12:54:10.263Z | INFO | device-manager@v1.1.12/control.go:240 | Completed activate sync ID [session:userGroups--67d7e91688c5fd08d0860039]
2025-03-17T12:54:10.263Z | INFO | device-manager@v1.1.12/control.go:227 | Processing activate sync ID [profiler:profiles--67d7e91688c5fd08d0860039]
2025-03-17T12:54:10.263Z | INFO | hermes/pxgrid.go:117 | Request to add new pxGrid subscriber [com.cisco.ise.config.profiler:topic] for DxHub stream profiler:profiles
2025-03-17T12:54:10.263Z | INFO | pxgrid/subscriber.go:28 | Request to create new subscriber: com.cisco.ise.config.profiler:topic
2025-03-17T12:54:10.270Z | INFO | pxgrid/subscriber.go:40 | Request to create new subscriber: service=com.cisco.ise.config.profiler , topicKey=topic and topicFQN=/topic/com.cisco.ise.config.profiler
2025-03-17T12:54:10.270Z | INFO | pxgrid/subscriber.go:55 | Subscriber[service: com.cisco.ise.config.profiler, topic: topic, id: cvc1msl3ct8r98jaf6e0] created successfully
2025-03-17T12:54:10.559Z | INFO | device-manager@v1.1.12/control.go:240 | Completed activate sync ID [profiler:profiles--67d7e91688c5fd08d0860039]
2025-03-17T12:54:10.559Z | INFO | device-manager@v1.1.12/control.go:227 | Processing activate sync ID [trustsec:securityGroups--67d7e91688c5fd08d0860039]
2025-03-17T12:54:10.559Z | INFO | hermes/pxgrid.go:117 | Request to add new pxGrid subscriber [com.cisco.ise.config.trustsec:securityGroupTopic] for DxHub stream trustsec:securityGroups
2025-03-17T12:54:10.559Z | INFO | pxgrid/subscriber.go:28 | Request to create new subscriber: com.cisco.ise.config.trustsec:securityGroupTopic 
!
2025-03-17T16:17:30.050Z | INFO | api-proxy@v1.0.10/broker.go:114 | API-Proxy: Broker Agent start consuming 
2025-03-17T16:17:30.050Z | INFO | hermes/apiproxy.go:43 | API Proxy connection established
2025-03-17T16:17:30.050Z | INFO | hermes/connectionstatus.go:62 | Setting cloud connection status to CONNECTED
2025-03-17T16:17:30.057Z | INFO | hermes/dxhub.go:94 | Policies are obtained from ISE : &{Pxgrid:{ContextOutTopics:[com.cisco.ise.sxp:bindingTopic com.cisco.ise.config.profiler:topic com.cisco.ise.endpoint:topic com.cisco.ise.radius:failureTopic com.cisco.ise.trustsec:policyDownloadTopic com.cisco.ise.echo:echoTopic com.cisco.ise.mdm:endpointTopic com.cisco.ise.config.trustsec:securityGroupTopic com.cisco.ise.config.trustsec:securityGroupAclTopic com.cisco.ise.config.anc:statusTopic com.cisco.ise.config.upn:statusTopic com.cisco.ise.session:sessionTopic com.cisco.ise.session:groupTopic]}}

限制

1.使用者無法在超過2個節點上啟用pxGrid雲角色。

2.支援從Catalyst雲門戶取消註冊到cdFMC，但不支援相反操作。

參考資料

使用pxGrid雲身份源的使用者控制

Cisco pxGrid雲端

Cisco pxGrid雲解決方案指南