Cisco Cisco Web Security Appliance S170 사용자 가이드

Some changes on the ISE server, such as certificate updates, require the ISE server or services 
running on it to restart. Any attempt to connect to the ISE server during this time will fail; however, 
eventually the connection will succeed.

This section contains explanations for ISE-related critical Log messages on the WSA:

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: Waiting for client connection 

timed out

The WSA’s ISE process failed to connect to the ISE server for 30 seconds.

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: WSA Client cert/key missing. 

Please check ISE config

The WSA Client certificate and key were not uploaded or generated on the WSA’s Identity Service 
Engine configuration page.

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: ISE service exceeded maximum 

allowable disconnect duration with ISE server

The WSA’s ISE process could not connect to the ISE server for 120 seconds and exited.

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: Subscription to updates failed …

The WSA’s ISE process could not subscribe to the ISE server for updates.

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: Could not create ISE client: …

Internal error when creating the WSA’s ISE client for ISE server connection.

Tue Mar 24 03:56:47 2015 Critical: ISEEngineManager: Bulk Download thread failed: …

Internal error indicating bulk download of SGTs failed on connection or re-connection.

Tue Mar 24 03:56:47 2015 Critical: ISEService: Unable to start service. Error: …

The WSA’s ISE service failed to start.

Tue Mar 24 03:56:47 2015 Critical: ISEService: Unable to send ready signal …

The WSA’s ISE service was unable to send a ready signal to 

heimdall

.

Tue Mar 24 03:56:47 2015 Critical: ISEService: Unable to send restart signal …

The WSA’s ISE service was unable to send a restart signal to 

heimdall

.

When a web access policy group has a custom URL category set to Monitor and some other component, 
such as the Web Reputation Filters or the DVS engine, makes the final decision to allow or block a 
request for a URL in the custom URL category, then the access log entry for the request shows the 
predefined URL category instead of the custom URL category.