pxGrid Internal CA Reference

pxGrid with Internal CA — Configuration Reference

This documents the complete pxGrid mTLS configuration using an internal CA, as deployed in the Domus Digitalis lab and applicable to Claroty xDome integration at work.

Cisco Official Documentation

Document URL

ISE 3.3 Admin Guide — pxGrid

www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_pxGrid.html

ISE 3.4 Admin Guide — pxGrid

www.cisco.com/c/en/us/td/docs/security/ise/3-4/admin_guide/b_ise_admin_3_4/b_ISE_admin_34_pxGrid.html

Configure pxGrid 2.0 with Certificates (Tech Note 215236)

www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215236-configure-pxgrid-2-0-with-certificates-a.html

ISE Security Ecosystem Integration Guide (216120)

www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216120-ise-security-ecosystem-integration-guide.html

pxGrid Developer Portal (SDK, cert generation, examples)

developer.cisco.com/docs/pxgrid/

pxGrid Certificate Generation

developer.cisco.com/docs/pxgrid/generating-certificates/

Claroty xDome ISE Integration Guide

claroty.com/resources/integration-briefs/cisco-ise
Tech Note 215236 is the single best Cisco doc for pxGrid certificate setup end-to-end. Search 215236 on cisco.com. The Developer Portal covers SDK usage and cert format conversion (PKCS12 → JKS/PEM).

ISE pxGrid + Microsoft CA — Cisco-Side Procedures

This section documents the ISE-side configuration when using Microsoft AD CS as the external CA for pxGrid client certificates. All steps reference the ISE 3.3/3.4 Administrator Guide and Tech Note 215236.

ISE Certificate Trust Store — Import Microsoft CA Chain

The Microsoft CA root certificate (and any subordinate/issuing CA) must be imported into ISE and explicitly trusted for pxGrid.

Step ISE Admin GUI Path and Action

1. Navigate to trust store

Administration → System → Certificates → Trusted Certificates

2. Import root CA

Click Import → Browse to the Microsoft root CA .pem file → Upload. Set Friendly Name to identify the CA (e.g., CHLA-Root-CA).

3. Import issuing CA (if two-tier PKI)

Click Import again → Upload the subordinate/issuing CA .pem. Set Friendly Name (e.g., CHLA-Issuing-CA).

4. Enable pxGrid trust on root CA

Select the imported root CA → Edit → Check: Trust for authentication of Cisco Services
Trust for client authentication and Syslog
Trust for authentication within ISE
Trust for pxGrid Controller ← required
Trust for pxGrid Subscriber ← required

5. Enable pxGrid trust on issuing CA

Same checkboxes as step 4 on the issuing CA certificate.

6. Verify chain

Both CAs should show green checkmarks in the Trust column.
Both Trust for pxGrid Controller and Trust for pxGrid Subscriber must be checked on every CA in the chain. Missing either flag is the #1 cause of pxGrid client rejection when using an external CA.

ISE pxGrid System Certificate — Issued by Microsoft CA

ISE’s pxGrid system certificate is the identity cert ISE presents to any pxGrid client (Claroty, FMC, Stealthwatch, custom scripts, etc.). In a distributed deployment, only the pxGrid controller nodes — PPAN and SPAN — need this certificate. PSNs with pxGrid enabled are publishers; they feed data to the controller but do not present a pxGrid identity cert to clients.

Distributed Deployment — Certificate Matrix
Node Role Needs pxGrid System Cert? Why

PPAN

pxGrid Controller (primary)

Yes

Clients connect here for registration, service lookup, and data

SPAN

pxGrid Controller (failover)

Yes

Takes over if PPAN fails; clients failover here

PSN-1, PSN-2, PSN-3

pxGrid Publisher

No

Publish session/profiling data to the controller; do not serve clients directly
CSR Details — One Per Controller Node
Field PPAN SPAN

CN

ise-ppan.chla.org

ise-span.chla.org

SAN

DNS:ise-ppan.chla.org

DNS:ise-span.chla.org

Certificate Usage

pxGrid

pxGrid

Two CSRs, two certs, same Microsoft CA template. Each cert generated on and bound back to its own node.

Steps — Per Node
Step ISE Admin GUI Path and Action

1. Generate CSR from ISE

Log into the node (PPAN or SPAN).
Administration → System → Certificates → Certificate Signing Requests → Generate Certificate Signing Requests.
Set Certificate Usage to: pxGrid.
Set Common Name to that node’s FQDN.
SAN: DNS:<that node’s FQDN>.

2. Submit CSR to Microsoft CA

Copy the CSR content. Submit via <ca-server>/certsrv → Advanced → Submit CSR → select the pxGrid certificate template.
Download the signed certificate (Base64 PEM).

3. Bind signed cert to ISE

Administration → System → Certificates → Certificate Signing Requests → Select the CSR → Bind Certificate.
Upload the signed .pem from the Microsoft CA.

4. Verify

Administration → System → Certificates → System Certificates → Confirm the new cert shows pxGrid in the Used By column.

5. Repeat for second node

Log into the other PAN and repeat steps 1–4 with that node’s FQDN.

pxGrid Client Certificate — For Any pxGrid Consumer

This is the certificate that any pxGrid client presents to ISE. The same process applies regardless of the consuming system — Claroty, FMC, Stealthwatch, Splunk, custom scripts, or any other pxGrid integration.

Step Action

1. Generate CSR

The client system generates a CSR with CN = its own FQDN (e.g., claroty-pxgrid.chla.org, fmc-01.chla.org).
Or: generate CSR via openssl req and import the signed cert into the client.

2. Sign via Microsoft CA

Submit CSR to AD CS using the pxGrid certificate template.
Web enrollment: <ca-server>/certsrv → Advanced → Submit CSR.
Or: certreq -submit -attrib "CertificateTemplate:pxGridClient" client.csr client.crt

3. Export in required format

Depends on the consuming system:

# PKCS12 (.pfx) — for appliances that import cert+key as one file
openssl pkcs12 -export -in client.crt -inkey client.key \
  -certfile ca-chain.pem -out client-pxgrid.pfx

# PEM — for Linux/script clients (separate cert and key)
# Already in correct format from Microsoft CA if exported as Base64

4. Import into client system

Upload the certificate, key, and CA chain into the client system’s pxGrid configuration.

5. Approve in ISE

Administration → pxGrid Services → Clients → The client appears with status PENDING → Click Approve.
Or: enable auto-approve under Administration → pxGrid Services → Settings → Automatically approve new certificate-based accounts.

pxGrid — Enable and Verify

Step ISE Admin GUI Path and Action

1. Enable pxGrid

Administration → pxGrid Services → Settings → Toggle pxGrid to Enabled.

2. Verify pxGrid persona

Administration → System → Deployment → Confirm pxGrid checkbox is checked on PPAN and SPAN.

3. Check client status

Administration → pxGrid Services → Clients → Connected clients show ENABLED.

4. Check services

Administration → pxGrid Services → Diagnostics → pxGrid Status → All services show green.

ISE pxGrid Certificate Requirements Summary (Cisco-Sourced)

Per the ISE Administrator Guide and Tech Note 215236:

Requirement Detail

CN (Common Name)

Must be a DNS-resolvable FQDN. The pxGrid Developer Docs state: "CN name should be Fully Qualified Domain Name (FQDN) resolvable." IP addresses and short names are rejected.

Extended Key Usage

Client Authentication (1.3.6.1.5.5.7.3.2) is mandatory. Without it, ISE’s pxGrid service rejects the certificate during TLS handshake.

Key type and size

RSA 2048-bit minimum. ISE generates 2048-bit by default via the built-in certificate generator.

Private key

Must be unencrypted (no passphrase). ISE pxGrid does not prompt for or accept passphrase-protected keys.

Certificate format

ISE generates PKCS12 by default. The pxGrid Developer Docs note: "PKCS12 format is not supported using Python libraries" — convert to PEM for script-based clients.

FQDNs only

All pxGrid nodes must be referenced by FQDN. IP addresses are not supported for pxGrid connections.

Full CA chain

ISE must have every certificate in the chain imported into Trusted Certificates with pxGrid trust flags. Missing an intermediate/issuing CA breaks validation.

Client approval

New pxGrid clients appear as PENDING until approved (manually or via auto-approve). Approval is per-client, not per-certificate.

ISE Admin Guide — Relevant Chapters

For the team to read directly in the ISE 3.3 or 3.4 Admin Guide:

Chapter Covers

pxGrid Node

Enable pxGrid, client management, auto-approve, diagnostics, pxGrid persona assignment.

Basic Setup → Certificate Management

Trusted Certificates store, system certificates, CSR generation, certificate binding, trust usage flags (pxGrid Controller, pxGrid Subscriber).

Basic Setup → Trusted Certificates

Import external CA certs, edit trust flags, view certificate chain, delete expired certs.

Deployment

Node personas — which node runs pxGrid Controller (typically PAN).

Troubleshooting → pxGrid

pxGrid diagnostics, connectivity checks, WebSocket status, client registration failures.
Search 215236 on cisco.com for the step-by-step tech note. It covers ISE internal CA and external CA (Microsoft/other) certificate workflows with screenshots.

Known Issue: Microsoft Multi-Tier CA Rejects pxGrid CSR

Error
Your certificate request was denied. Your Request Id is XXXXXXX.
The disposition message is "Error Constructing or Publishing Certificate
Invalid Issuance Policies: 2.5.29.32.0"

May also include: "The certificate validity period will be shorter than the certificate template specifies, because the template validity period is longer than the maximum certificate validity period allowed by the CA."

Root Cause

Two compounding issues:

Issue Detail

Invalid Issuance Policies (2.5.29.32.0)

The template has All Issuance Policies (anyPolicy, OID 2.5.29.32.0) in the Extensions tab. This works on a standalone Microsoft CA but fails on multi-tier CA (root + issuing CA). The issuing CA cannot publish certificates with the anyPolicy OID when constrained by a root CA policy.

Validity period mismatch

The template requests a validity period longer than the CA’s configured maximum. The CA caps certificate lifetime via ValidityPeriodUnits.
Fix

Issue 1 — Remove All Issuance Policies:

  1. certtmpl.msc → open the pxGrid template

  2. Extensions tab → select Issuance Policies → Edit

  3. Remove All Issuance Policies from the list — do not just leave it empty, actively remove the entry

  4. OK → Apply

Issue 2 — Align validity period:

  1. Check CA maximum:

    certutil -getreg CA\ValidityPeriodUnits
certutil -getreg CA\ValidityPeriod

  2. certtmpl.msc → pxGrid template → General tab → set validity period equal to or less than the CA maximum

  3. Or extend the CA maximum (requires CA admin authority):

    certutil -setreg CA\ValidityPeriodUnits 5
certutil -setreg CA\ValidityPeriod "Years"
net stop certsvc && net start certsvc

Then resubmit the CSR.

Source

Cisco Community: ISE 2.2 pxGrid — issue with CSR signing by CA server — confirmed fix: "had to remove the 'All Issuance Policies' from the list under the Extensions tab and then it worked right away." Standalone CA works fine; multi-tier CA triggers this error.

Authentication Model

pxGrid 2.0 uses mTLS + Basic auth with empty password. The client presents a certificate signed by a CA that ISE trusts, plus a Basic auth header where the username is the pxGrid client name and the password is empty.

curl -sS -k \
  --cert "${ISE_PXGRID_CERT}" \
  --key "${ISE_PXGRID_KEY}" \
  -u "${ISE_PXGRID_CLIENT_NAME}:" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{}' \
  "https://${ISE_PXGRID_FQDN}:8910/pxgrid/control/AccountActivate"

The -u client: with empty password is required — ISE expects the Basic auth header even though mTLS handles real authentication.

Required Certificate Files

Variable Purpose Path Pattern

ISE_PXGRID_CA

CA certificate that signed the client cert (must be trusted by ISE)

~/.secrets/certs/d00x/ise/pxgrid.crt

ISE_PXGRID_CERT

Client certificate (PEM format)

~/.secrets/certs/d00x/ise/pxgrid-client.crt

ISE_PXGRID_KEY

Client private key (must be unencrypted PEM)

~/.secrets/certs/d00x/ise/pxgrid-client.key
Private keys must be unencrypted. ISE pxGrid will not negotiate with passphrase-protected keys. FQDNs are required for all nodes — IP addresses are not supported.

Additional Environment Variables

Variable Default Purpose

ISE_PXGRID_FQDN

Falls back to ISE_PAN_FQDN

FQDN of the pxGrid controller node

ISE_PXGRID_CLIENT_NAME

netapi-pxgrid

Client identity for Basic auth and ISE client registry

ISE_PXGRID_PORT

8910

pxGrid HTTPS + WebSocket port

ISE_PXGRID_BASE_URL

https://{pan-fqdn}:8910/pxgrid

Full base URL for pxGrid REST calls

Certificate Generation

Two paths: CSR via OpenSSL submitted to ISE, or issued directly from Vault PKI.

Option 1: OpenSSL CSR → ISE Signs

# Generate key + CSR
openssl req -new -newkey rsa:2048 -nodes \
  -keyout pxgrid-client.key \
  -out pxgrid-client.csr \
  -subj "/CN=pxgrid-client.inside.domusdigitalis.dev"

# Submit to ISE:
#   Administration > pxGrid Services > Certificates > Generate Certificate
#   Upload CSR, download signed cert as pxgrid-client.crt

Option 2: Vault PKI Issues Directly

vault write pki_int/issue/domus-client \
  common_name="pxgrid-client.inside.domusdigitalis.dev" \
  ttl="8760h"

Option 3: Microsoft AD CS (Enterprise CA)

This is the production path when the organization runs Active Directory Certificate Services.

Certificate Field Requirements
Field Requirement Source

CN (Common Name)

Must be a DNS-resolvable FQDN. This becomes the pxGrid client identity in ISE. Example: claroty-pxgrid.example.com

Cisco pxGrid Developer Docs: "CN name should be Fully Qualified Domain Name (FQDN) resolvable"

Key Usage

Digital Signature, Key Encipherment

RFC 5280 §4.2.1.3 — required for TLS client authentication

Extended Key Usage (EKU)

Client Authentication (1.3.6.1.5.5.7.3.2) — required. Server Authentication (1.3.6.1.5.5.7.3.1) — recommended.

RFC 5280 §4.2.1.12; ISE pxGrid rejects certs missing Client Authentication EKU

Key Type

RSA 2048-bit minimum (4096 recommended)

Cisco ISE Admin Guide — pxGrid chapter

Private Key

Must be unencrypted — no passphrase protection

Validated in lab (d000) and production (d001) configurations

Format

PEM for Linux/script clients, PKCS12 (.pfx) for Java and Claroty appliance

Cisco pxGrid Developer Docs — PKCS12 default, PEM for testing

SAN (optional)

Add Subject Alternative Name entries if the client uses multiple FQDNs

RFC 5280 §4.2.1.6

Validity Period

Match organizational policy. 1 year (8760h) is common.

Organizational policy
Microsoft AD CS Template Requirements
Template Setting Value Where in MMC

Base template

Duplicate Web Server (or Computer)

certtmpl.msc → right-click → Duplicate

Template name

pxGrid Client (display name and CN)

General tab

Purpose

Signature and encryption

Request Handling tab

Exportable

Mark private key as exportable — Yes

Request Handling tab

Application Policies (EKU)

Client Authentication (1.3.6.1.5.5.7.3.2) + Server Authentication (1.3.6.1.5.5.7.3.1)

Extensions tab → Application Policies → Edit

Key Usage

Digital Signature, Key Encipherment

Extensions tab → Key Usage → Edit

Subject Name

Supply in the request (CN comes from the CSR, not AD)

Subject Name tab

Minimum key size

2048

Cryptography tab

Enrollment permissions

Grant Enroll to the service account or computer requesting the cert

Security tab

Publish template

certsrv.msc → Certificate Templates → New → select pxGrid Client

CA management console
Step 1: Create the Template

On the CA server:

  1. Open Certificate Templates Console (certtmpl.msc)

  2. Right-click Web Server → Duplicate Template

  3. Configure all settings per the table above

  4. Publish: certsrv.msc → Certificate Templates → New → Template to Issue → select pxGrid Client

Step 2: Generate CSR and Submit
# Generate key + CSR (from Linux or Claroty appliance)
openssl req -new -newkey rsa:2048 -nodes \
  -keyout pxgrid-client.key \
  -out pxgrid-client.csr \
  -subj "/CN=claroty-pxgrid.example.com"

Submit the CSR via one of:

  • Web enrollment: <ca-server>/certsrv → Request a certificate → Advanced → Submit CSR → select pxGrid Client template

  • certreq.exe (from Windows):

    certreq -submit -attrib "CertificateTemplate:pxGridClient" pxgrid-client.csr pxgrid-client.crt
Step 3: Export the CA Chain
# Export root CA cert (DER → PEM)
certutil -ca.cert root-ca.cer
openssl x509 -inform DER -in root-ca.cer -out root-ca.pem

# If two-tier PKI (subordinate/issuing CA), export and concatenate
certutil -ca.cert -config "SubCA\IssuingCA" issuing-ca.cer
openssl x509 -inform DER -in issuing-ca.cer -out issuing-ca.pem
cat issuing-ca.pem root-ca.pem > ca-chain.pem
Step 4: Import CA Chain into ISE

The Microsoft CA root (and any subordinate/issuing CA) must be imported into ISE’s Trusted Certificates store with pxGrid trust enabled. See the ISE-Side Configuration section below.

Two-tier PKI is the #1 cause of pxGrid trust failures. If your AD CS uses root + issuing CA, both must be imported into ISE. Missing the issuing CA breaks the chain.
Output Formats by Consumer
Consumer Format Notes

Claroty appliance

PKCS12 (.pfx)

Appliance imports cert + key as single file

Linux script clients

PEM (.crt + .key)

Separate cert and unencrypted key files

Java clients

JKS (.jks)

Convert from PKCS12 via keytool

ISE trust store

PEM (.pem)

CA chain — root + any subordinate
Reference Standards
Standard Governs

Cisco pxGrid Developer Docs — Certificate Generation

CN must be FQDN; PKCS12 default format; PEM for testing

Cisco Tech Note 215236

End-to-end pxGrid 2.0 certificate setup with ISE

ISE 3.3 Admin Guide — pxGrid Chapter

pxGrid trust configuration, client approval, certificate requirements

Microsoft — Manage Certificate Templates in AD CS

Duplicating templates, configuring properties, publishing to CA. Requires Domain Admins.

Microsoft — Certificate Template Concepts

Template versions (v1/v2/v3), default templates, compatibility settings. Web Server template = base for pxGrid.

Microsoft — Certificate Enrollment Web Services

CSR submission, template configuration, certreq usage, web enrollment, constrained delegation.

RFC 5280 §4.2.1.12

Extended Key Usage OID definitions (Client Auth: 1.3.6.1.5.5.7.3.2)

RFC 5280 §4.2.1.3

Key Usage field definitions (Digital Signature, Key Encipherment)
Microsoft AD CS — Step-by-Step Reference

The following procedure is sourced from Microsoft: Manage certificate templates in Windows Server.

Prerequisites

  • Member of Domain Admins to manage certificate templates

  • RSAT AD CS management tools installed:

    Install-WindowsFeature RSAT-ADCS
Creating the Template (Detailed)
Step Action (per Microsoft documentation)

1. Open snap-in

Run mmc → File → Add/Remove Snap-in → Certificate Templates → OK. Connect to the AD CS Enterprise root or subordinate CA server.

2. Duplicate template

Right-click Web Server → Duplicate Template. Choose minimum CA compatibility: Windows Server 2016. Choose minimum recipient: Windows 10 / Windows Server 2016.

3. General tab

Template display name: pxGrid Client. Template name (CN): pxGridClient (no spaces — used by certreq -attrib).

4. Request Handling tab

Purpose: Signature and encryption. Check: Allow private key to be exported.

5. Subject Name tab

Select: Supply in the request. This allows the CSR to specify the CN (FQDN) rather than pulling from AD.

6. Extensions tab — Application Policies

Edit → Add: Client Authentication (1.3.6.1.5.5.7.3.2) — required. Server Authentication (1.3.6.1.5.5.7.3.1) — recommended.

7. Extensions tab — Key Usage

Digital Signature — checked. Key Encipherment — checked.

8. Cryptography tab

Minimum key size: 2048. Provider category: Key Storage Provider or Legacy CSP.

9. Security tab

Grant Read + Enroll to the user or service account requesting certs. For Claroty: grant to the account submitting the CSR on behalf of the appliance.

10. Publish

Open certsrv.msc → expand CA → right-click Certificate Templates → New → Certificate Template to Issue → select pxGrid Client → OK.
Submitting the CSR

Method 1 — Web Enrollment (if CA Web Enrollment role is installed):

  1. Browse to <ca-server>/certsrv

  2. Click Request a certificate → advanced certificate request

  3. Paste the CSR (from openssl req) or upload the .csr file

  4. Select Certificate Template: pxGrid Client

  5. Submit → download the signed certificate (Base64 or DER)

Method 2 — certreq.exe (from any domain-joined Windows machine):

certreq -submit -attrib "CertificateTemplate:pxGridClient" .\pxgrid-client.csr .\pxgrid-client.crt

Method 3 — PowerShell (for automated enrollment):

# If the machine can autoenroll, trigger it directly:
certutil -pulse
Exporting the Signed Certificate
# Export as PKCS12 (.pfx) — includes private key (for Claroty appliance)
certutil -exportPFX -p "TempPassword123!" my "claroty-pxgrid.example.com" pxgrid-client.pfx

# Convert PKCS12 to PEM (for Linux/script clients)
openssl pkcs12 -in pxgrid-client.pfx -clcerts -nokeys -out pxgrid-client.crt
openssl pkcs12 -in pxgrid-client.pfx -nocerts -nodes -out pxgrid-client.key
Exporting the CA Chain
# Export root CA certificate
certutil -ca.cert root-ca.cer

# Convert DER to PEM
openssl x509 -inform DER -in root-ca.cer -out root-ca.pem

# For two-tier PKI — export issuing CA cert too
certutil -ca.cert -config "SERVER\IssuingCA" issuing-ca.cer
openssl x509 -inform DER -in issuing-ca.cer -out issuing-ca.pem

# Concatenate full chain (issuing first, root last)
cat issuing-ca.pem root-ca.pem > ca-chain.pem
Verify the Certificate
# Check subject, issuer, EKU, validity
openssl x509 -in pxgrid-client.crt -noout -subject -issuer -dates -ext extendedKeyUsage

# Verify chain
openssl verify -CAfile ca-chain.pem pxgrid-client.crt

ISE-Side Configuration

Step Action

1. Import CA

Administration > System > Certificates > Trusted Certificates > Import. Upload the CA cert (PEM format) that signed the pxGrid client certificate. For Microsoft AD CS: import both root CA and any subordinate/issuing CA in the chain.

2. Enable pxGrid

Administration > pxGrid Services > Settings. Toggle pxGrid to enabled.

3. Trust for pxGrid

Administration > System > Certificates > Trusted Certificates. Edit the imported CA — check Trust for pxGrid Controller and Trust for pxGrid Subscriber.

4. Client Approval

Administration > pxGrid Services > Clients. Set auto-approve or manually approve each client as it connects.

Client Registration Flow

1. Client presents cert signed by trusted CA
2. ISE validates cert chain against pxGrid trusted store
3. ISE registers client name from CN or Basic auth username
4. Client calls /control/AccountActivate
   → Returns: ENABLED, PENDING, or DISABLED
5. If PENDING: admin approves in ISE GUI (or auto-approve is on)
6. Client discovers services via /control/ServiceLookup

pxGrid Topics

Topic Events

com.cisco.ise.session

Session connect/disconnect, CoA results, auth status changes

com.cisco.ise.config.profiler

Endpoint profiled, profile changed, certainty factor updated

com.cisco.ise.config.endpoint

Endpoint created/updated/deleted in ISE database

com.cisco.ise.config.anc

ANC policy applied/cleared (quarantine actions)

com.cisco.ise.trustsec

SGT assignments, SXP bindings, policy changes

com.cisco.ise.mdm

MDM compliance status changes

com.cisco.ise.radius

RADIUS authentication events

Claroty xDome Integration via pxGrid

Claroty acts as both publisher and subscriber on pxGrid.

What Claroty Pushes to ISE

Topic: com.cisco.ise.config.endpoint
Action: UPDATE
Attributes pushed:
  assetVendor     → e.g. "TCP Software"
  assetProductId  → e.g. "TimeClock Plus"
  assetDeviceType → e.g. "Time Clock"

Full Profiling Chain

Claroty xDome discovers device on network
  → Classifies: vendor, product, device type
    → Pushes attributes to ISE via pxGrid (port 8910)
      → ISE profiling policy matches on custom attributes
        → Endpoint profile assigned
          → Authorization rule matches
            → dACL applied

What Claroty Reads from ISE

Bidirectional — ISE sends session data to Claroty for device discovery context:

  • Session connect/disconnect events

  • Endpoint MAC, IP, switch, port

  • Authentication method (MAB, dot1x)

ISE Fields Available in Claroty API

Claroty Field ISE Equivalent

ise_identity_group_list

Identity group assignment

ise_endpoint_profile_list

Profiler classification

ise_security_group_name_list

TrustSec SGT name

ise_logical_profile_list

Logical profile (grouping)

ise_authentication_method_list

MAB, dot1x

enforcement_or_authorization_profiles_list

Applied authorization profile

applied_acl_list

Applied ACL name

applied_acl_type_list

dACL, filter-id, etc.

Claroty pxGrid Certificate Requirements

For Claroty to connect to ISE via pxGrid with an internal CA, Claroty needs:

Requirement Detail

Client certificate

Signed by the same internal CA that ISE trusts for pxGrid. CN becomes the pxGrid client name visible in ISE.

Client private key

Unencrypted PEM. Claroty appliance stores this.

CA certificate

The internal CA chain — Claroty needs this to verify ISE’s server cert.

ISE PAN FQDN

Must use FQDN, not IP. Claroty connects to ISE PAN on port 8910.

Firewall rule

Port 8910 open from Claroty appliance → ISE PAN.

ISE client approval

Approve the Claroty pxGrid client in ISE Admin > pxGrid Services > Clients.

Troubleshooting

Step Check How

1

Claroty sees the device?

Query Claroty device inventory by MAC

2

Claroty classified it?

Check manufacturer, device_type fields populated

3

pxGrid active?

ISE Admin > pxGrid Services — Claroty client shows ENABLED

4

ISE received attributes?

ers "/endpoint/{id}" | jq '.ERSEndPoint.customAttributes'

5

ISE profiling matched?

Check RADIUS auth log for correct endpoint_profile

6

None of above?

pxGrid push failure — escalate to Claroty vendor with MAC + status from both sides

Verification Commands

# Activate / check client status
pxgrid "control/AccountActivate" | jq '.'
# → {"accountState":"ENABLED"}

# Discover session service
pxgrid "control/ServiceLookup" '{"name":"com.cisco.ise.session"}' | jq '.'

# Discover ANC service
pxgrid "control/ServiceLookup" '{"name":"com.cisco.ise.config.anc"}' | jq '.'

# Discover all services
for svc in session anc endpoint trustsec egress system mdm radius sxp; do
  echo "=== $svc ==="
  pxgrid "control/ServiceLookup" "{\"name\":\"com.cisco.ise.${svc}\"}" | jq -r '.services[0].properties.restBaseUrl // "NOT FOUND"'
done

Lab vs Production Comparison

Aspect Lab (d000) Production (d001)

Deployment

Standalone

Distributed

pxGrid node

Same as PAN

PAN (pxGrid controller role)

Cert path

~/.secrets/certs/d000/ise/

~/.secrets/certs/d001/ise/

Credential load

dsource d000 dev/network/ise

dsource d001 dev/network/ise

Claroty integration

Lab testing

BMS Controller Segmentation project

Source Files

File Location

pxGrid function

data/d000/infra/ise-api-reference/scripts/lib/ise-common.sh

activate.sh

data/d000/infra/ise-api-reference/scripts/pxgrid/activate.sh

discover-services.sh

data/d000/infra/ise-api-reference/scripts/pxgrid/discover-services.sh

anc-policies.sh

data/d000/infra/ise-api-reference/scripts/pxgrid/anc-policies.sh

Architecture partial

data/shared/partials/ise-pxgrid/architecture.adoc

pxGrid overview

data/d000/infra/ise-api-reference/partials/pxgrid-overview.adoc

Claroty ISE integration

data/d000/infra/claroty-api-reference/partials/ise-integration.adoc

Lab env template

data/d000/templates/network-ise.env.template

Prod env template

data/d001/templates/network-ise.env.template