Troubleshooting =============== The troubleshooting section contains tips and frequently asked questions for common issues. HTTP 403 Error during login ----------------------------- When a user enters an incorrect username or password, it will result in an HTTP 401 error. However, if the response is instead an HTTP 403 error, the login was successful, but the back-end authentication server didn't return any user roles (aaa-groups). A reason for this happening could be due to a too restrictive filter in the AAA_AUTHORIZATION_GROUP_REGEX setting. For RADIUS authentication, the problem could be that the RADIUS policy is misconfigured and doesn't return any groups. For LDAP, the issue could be an incorrect LDAP search base. Communication errors to and from containers ------------------------------------------- One issue that can arise is that it's not possible to communicate with the Docker containers, as mentioned in the :doc:`installation guide `, Docker chooses the network range of 172.0.0.0/16 and assigns /24 subnets from that pool. It could be that the ingress web proxy will be running in the 172.0.0.0/24 network, this would make it impossible for any clients outside of the Docker to connect to the webserver. Another problem is if the API or pxGrid containers are running on the same network as the ISE servers then the application won't be able to connect to the cluster. If this is the case the Docker should be be configured to use another default-address-pools as per the docker configuration instructions. https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file