Solution | A pxGrid connector on FortiManager is available to use SSO with authentication managed by Cisco ISE, as explained here: Creating Cisco pxGrid connectors.
The communication between FortiManager and ISE is encrypted using TLS.
As usual for communications via TLS, it is necessary to use the correct certificates. For instructions on how to configure them, see the document above.
The following is an article showing a scenario featuring a TLS problem: Technical Tip: pxGrid integration fails after certificate renewal with HTTP 401 unauthorized. If the connector stops working but the TLS handshake is fine, one viable workaround is to manually retrieve the security groups again: From the FortiManager, go to: Policy & Objects -> Expand the Security Fabric section (in the menu below) -> Endpoint/Identity -> Pxgrid Connector -> Selecting the related entry -> Expand the menu under the More button and select Import.
Prerequisites and info about the connection between ISE and the FortiManager: Starting from release v7.4.7, FortiManager supports an ISE distributed environment, but needs to be configured as explained in PxGrid Connector supports Cisco ISE distributed environment with the secondary-server filed available under the Advanced Option section. Traffic between FortiManager and the secondary ISE is expected only if the communication with the first fails.
For FortiManager units in high availability, if the primary node changes, the new primary node needs to retrieve from the ISE security groups list. To speed up this process, it can be imported as explained before.
To perform the TLS, use the server and client certificates generated by the internal ISE CA (Certification Authority) or from an external CA. How to import a certificate on FortiManager is explained here: Local certificates.
It is not necessary to push the pxGrid connector's client certificate installed on ForrtiMager on managed FortiGates, because only the FortiManager communicate with the ISE.
In case: TLS handshake fail between FortiManager and ISE. ISE is running the release v3.3 or earlier. The problem began after a new set of certificates generated by an external CA after May 2026 has been uploaded.
The issue may be caused by a Client EKU check, as explained in Allow server EKU certificates for Cisco pxGrid: Allow server EKU certificates for Cisco pxGrid.
Assuming that the pxGrid connector is up, the following information is important to know in cases where a user is not authenticated by a FortiGate firewall policy, because the login event is not received by the FortiManager, but the related log is available on ISE:
To verify that the FortiGate is not receiving the SSO login event, use the command 'diagnose debug authd fsso list', as explained in the 'CLI for FortiManager and FortiGate' section of the documentation page provided at the beginning of this article.
pxGrid is a standard communication created by Cisco, based on RFC 8600, that defines the XMPP (Extensible Messaging and Presence Protocol).
The XMPP protocol is based on the Publish-Subscribe mechanism. The ISE always acts as Publisher, notifying the FortiManager of SSO events, which in turn acts as as Subscriber.
FortiManager forwards the events, for which it has been notified by Cisco ISE, to the FortiGates via Fabric SSO.
FortiManager is the only Fortinet product supporting the pxGrid connector.
Version 2 of the pxGgrid uses the Websocket ping-pong mechanism (explained in the RFC 6465) to permit to the communication initiator (ISE) to check the peer is still reachable.
If ISE does not receive pong frames, it closes the Websocket and a quota of SSO events may be lost, because the FortiManager was not notified and was unavailable as a web-socket to publish them.
Sometimes, ping frames may be sent by the ISE but not received by the FortiManager and vice versa. For example: due to link flaps, routing instability, link saturation and so on. To verify ping or pong frames are missing, perform the following: Collect a pcap for the pxGrid connector traffic on the ISE and FortiManager used interfaces. The steps for capturing traffic with FortiManager are explained in Packet capture.
Ping and pong frames are not visible upon opening the pcap with Wireshark because the packets are encrypted by the TLS (marked as 'Application Data').
It is necessary to find the TLS private Key, executing steps 4 and 5 from Export SSL certificate and private key from keystore.
Decrypt TLS traffic using Wireshark as explained into the TLS Decrypting Section of this Wiki Wireshark page: TLS.
Use the Wireshark filter 'websocket.opcode == 9 || websocket.opcode == 10' to find pings (opcode 09) and pongs (opcode 10).
Any firewall in the middle 'misconfigured' with a proxy feature and certificate deep inspection enabled may be responsible for a communication issue, if pings or pongs are not associated with the pxGrid communication allowed. Related document: Creating Cisco pxGrid connectors |
