Cisco Cisco Web Security Appliance S670 User Guide

These Trace-level log entries on the WSA show that after 30 seconds the attempts to connect to the ISE 
server are terminated.

If connection to the ISE server fails during the Start Test on the Identity Services Engine page 
(

), check connectivity to the configured ISE server on ports 443 

and 5222. 

Port 5222 is the official client-to-server Extensible Messaging and Presence Protocol (XMPP) port, 
and is used for connection to the ISE server; it is also used by applications such as Jabber and Google 
Talk. Note that some firewalls are configured to block port 5222.

Tools that can be used to check connectivity include 

tcpdump

.  

The following issues can cause failure when the WSA attempts to connect with the ISE server:

Licenses on the ISE server have expired.

The pxGrid node status is “not connected” on the ISE server’s Administration > pxGrid Services 
page. Be sure Enable Auto-Registration is selected on this page.

Outdated WSA clients (specifically “test_client” or “pxgrid_client”) are present on the ISE server. 
These need to be deleted; see Administration > pxGrid Services > Clients on the ISE server.

The WSA is attempting to connect to the ISE server before all its services are up and running.

Some changes on the ISE server, such as certificate updates, require the ISE server or services 
running on it to restart. Any attempt to connect to the ISE server during this time will fail; however, 
eventually the connection will succeed.

This section contains explanations for ISE-related critical Log messages on the WSA:

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: Waiting for client connection 

timed out