Resolve Incomplete CTS Profile and SGACL Download Failures on IOS-XE Devices Integrated With Cisco ISE

Available Languages

Download Options

  • PDF     (19.1 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (87.7 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (73.8 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:November 8, 2026
Document ID:226566

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Issue

You observe partial or incomplete Cisco TrustSec (CTS) profiles on network devices even when the CTS server list and environment data are present. The network device fails to download Security Group Access Control List (SGACL) Access Control Entries (ACEs).

This issue affects deployments using Cisco IOS® XE network devices such as Catalyst 9000 series switches, Wireless LAN Controllers (WLC), and routers with Identity Services Engine (ISE).

This error appears in the network device logs:

%CTS-2-AUTHZ_POLICY_SGACL_ACE_FAILED: Failed to download ACEs for SGACL '<ACLname>' for SGT='<SGTnumber>:<SGTname>' due to ACE 'missing/incomplete' error. Download will be retried in 60 seconds

Environment

  • ISE 3.5 patch 2

  • ISE 3.3 patch 8

  • ISE 3.2 patch 9

  • CTS environment

  • IOS-XE network devices like Cat9k, WLC and routers

Resolution

Option A: Upgrade ISE (Recommended)

To permanently resolve this issue, upgrade Cisco ISE to a fixed release where the Cisco Bug ID CSCws51319 is resolved.

  • Fixed Releases:

    • ISE 3.5 Patch 3 or newer

    • ISE 3.3 Patch 9 or newer

    • ISE 3.2 Patch 10 or newer

Option B: Manual Policy Refresh (Workaround)

If an upgrade is not immediately possible, you must manually trigger a policy refresh on the network device whenever a policy change is made in ISE.

1 . Access the CLI of the affected network device.

2 . Run this command to verify the CTS PAC status.

show cts pac

3 . To verify the CTS environment data is present, run the command:

show cts environment data

4 . To check the current policy permissions, run:

show cts role-based permissions

5 . Run the command to refresh the policy:

cts refresh policy

6 . Wait a few minutes for the download to complete.

7 . Check the current policy condition and confirm if all the permissions are downloaded using this command:

show cts role-based permissions

Cause

This issue is due to Cisco Bug ID CSCws51319.

Related Content

Revision History

Revision Publish Date Comments
1.0
07-Nov-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Pavithra G

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products