Cisco ISE pxGrid Down: show application status When DNAC or FMC Goes Blind

Cisco ISE · Techclick CLI troubleshooting lab

DNAC cannot learn SGT or session data from ISE. pxGrid client shows offline.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

pxGrid is a service plus certificates. show application status ise and the pxGrid cert trust. Do not rebuild ISE.

Why this ticket shows up

Consumers need the pxGrid service up and a trusted client cert. Either side failing looks like 'ISE is down' when RADIUS is fine.

Symptoms operators actually see

• RADIUS works, pxGrid clients offline

• After an ISE patch

• Client cert expired

• Node group split

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show application status ise
show logging application pxgrid.log tail 50
show clock
show cpu
show ntp

How to read that output

pxGrid processes must be running. Time skew plus certs is a classic post-patch failure.

Triage order

1. Confirm pxGrid services running

2. Check clock/NTP

3. Re-approve the consumer in ISE

4. Replace expired client cert

5. Retest SGT/session download

Classic traps

What you see	Real cause	Fix
Restart all ISE nodes	One consumer cert expired	Fix that client
Disable pxGrid	RADIUS is not the issue	Keep AAA up
Rebuild DNAC	Trust was withdrawn after patch	Re-approve

Proof the ticket is closed

• Consumer online

• SGT or sessions populate

• RADIUS still healthy

Say this in an interview

I separate AAA from pxGrid. Users can authenticate while DNAC is blind.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/