Add ISE 1.3 in a cluster of ISE 1.2

Hello,
I have a cluster of 2 cisco ISE 1.2 VM (primary and secondary) and I would like to add two other 1.3 VM as secondary as well.
Do you have any tips especially in terms of certificate?
Regards
Eric

Similar Messages

Cannot add multiple members of a failover cluster to a DFSR replication group

Server 2012 RTM. I have two physical servers, in two separate data centers 35 miles apart, with a GbE link over metro fibre between them. Both have a large (10TB+) local RAID storage arrays, but given the physical separation there is no physical shared storage.
The hosts need to be in a Windows failover cluster (WSFC), so that I can run high-availability VMs and SQL Availability Groups across these two hosts for HA and DR. VM and SQL app data storage is using a SOFS (scale out file server) network share on separate
servers.
I need to be able to use DFSR to replicate multi-TB user data file folders between the two local storage arrays on these two hosts for HA and DR. But when I try to add the second server to a DFSR replication group, I get the error:
The specified member is part of a failover cluster that is already a member of the replication group. You cannot add multiple members for the same cluster to a replication group.
I'm not clear why this has to be a restriction. I need to be able to replicate files somehow for HA & DR of the 10TB+ of file storage. I can't use a clustered file server for file storage, as I don't have any shared storage on these two servers. Likewise
I can't run a HA single DFSR target for the same reason (no shared storage) - and in any case, this doesn't solve the problem of replicating files between the two hosts for HA & DR. DFSR is the solution for replicating files storage across servers with
non-shared storage.
Why would there be a restriction against using DFSR between multiple hosts in a cluster, so long as you are not trying to replicate folders in a shared storage target accessible to both hosts (which would obviously be a problem)? So long as you are not replicating
folders in c:\ClusterStorage, there should be no conflict.
Is there a workaround or alternative solution?

Yes, I read that series. But it doesn't address the issue. The article is about making a DFSR target highly available. That won't help me here.
I need to be able to use DFSR to replicate files between two different servers, with those servers being in a WSFC for the purpose of providing other clustered services (Hyper-V, SQL availability groups, etc.). DFSR should not interfere with this, but it
is being blocked between nodes in the same WSFC for a reason that is not clear to me.
This is a valid use case and I can't see an alternative solution in the case where you only have two physical servers. Windows needs to be able to provide HA, DR, and replication of everything - VMs, SQL, and file folders. But it seems that this artificial
barrier is causing us to need to choose either clustered services or DFSR between nodes. But I can't see any rationale to block DFSR between cluster nodes - especially those without shared storage.
Perhaps this blanket block should be changed to a more selective block at the DFSR folder level, not the node level.

ISE - CSCty54756 - how do I reindex a ISE database? Need help please!

Anybody know how to implement the workaround below?
Indexes got corrupted in MNT DB
CSCty54756
Symptom:
The ISE Dashboard will not show up any activities and when checked in the mnt-collector.out log file from support bundle you will see indexing errors
Conditions:
If you see indexing error as below :
java.sql.SQLException: ORA-01502: index 'MNT.SYS_C0011721' or partition of such index is in unusable state.
java.sql.SQLException: ORA-01502: index 'MNT.SYS_C0011720' or partition of such index is in unusable state
Workaround:
As a quick workaround Indexes needs to be re-executed and all this execution needs to be done under the guidance of MNT Dev
Further Problem Description:
When you observe if the dash board is not logging any information , even though authentications are happening successfully , then when we check the support bundle for mnt-collector.out log and if we happen to see the above SQL Exceptions , we can conclude that due to index errors , dash board is not writing any logs.

Hello all,
I actually have the same problem with my Cisco ISE with Dashboard showing nothing and cisco ISE returning Database Failure like as shown below:
"Database failure (nnpc-ise, Posture)
Exception:
ORA-01502: index 'MNT.SYS_C0011756' or partition of such index is in unusable state"
Kindly advise me on how i can fix this error.
NOTE: I AM USING CISCO AS AS STANDALONE MODE I DO NOT HAVE MONITORING NODE.

Add IPv6 to a running failover cluster

Hi
I have a sql failover cluster running win2k8 R2 and SQL 2008 it was built around IPv4 the instance listens on IPv4 cluster IP address ( virtual IP)
I rescently got a request that there will be servers running in pure IPv6 networks and the need to be able to talk directly to the database using IPv6 that where I need to add a cluster IPv6.
The database is the backend for our backup server and it cannot be taken offline or allow a downtime of more than 30 minutes so rebuilding the cluster is out of questions
So my question how do I go by and add the IPv6 cluster address alongside the IPv4, I am not reffering to an IPv6 Resource.
Any suggestions will be very appreciated
Regards

Hello,
Please try to configure the NIC on the nodes for IPv6 and make sure the Host Record (A) has been created for IPv6 on the DNS server. I think that’s all you need.
I am sorry for the late response, I did not notice the thread on the forum.
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

"Failed to connect to the service manager" when I try to add nodes to a cluster on Windows Server 2008 R2

Hello,
I get the following error message everytime I try to add a node to an existing cluster "Failed to connect to the service manager".
I'm running Windows Server 2008 R2,
Any ideas?

Hi saeedawadx,
Please run the cluster validation and post the error or warning information, in normal scenario the “Failed to connect to the service manager” issue often caused by the firewall
or AV soft block the others node connect, please try to disable the firewall and AV soft then try again.
The following related article will give more helpful tips,
The case of the server who couldn’t join a cluster – operation returned because the timeout period expired
http://blogs.technet.com/b/roplatforms/archive/2010/04/28/the-case-of-the-server-who-couldn-t-join-a-cluster-operation-returned-because-the-timeout-period-expired.aspx
Trouble Connecting to Cluster Nodes? Check WMI!
http://blogs.msdn.com/b/clustering/archive/2010/11/23/10095621.aspx
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Cisco ise 1.2 install certificates for ise cluster question

hello all i have an ise cluster of 4 devices. 1 primary admin/secondary monitor, 1 secondary admin/primary admin and 2 policy nodes
i need to install public CA certs on them. can I generate 1 CSR on one of the nodes, that includes a SAN with the DNS names of all the nodes?
Therefore get only 1 cert from the CA, and export and import the same cert into all the other nodes?
or do i have to generate 1 CSR for each node and purchase 4 certs? Wild card certs is not an option. tHANKS,

ISE allows you to install a certificate with multiple Subject Alternative Name (SAN) fields. A browser reaching the ISE using any of the listed SAN names will accept the certificate without any error as long as it trusts the CA that signed the certificate.
The CSR for such a certificate cannot be generated from the ISE GUI. http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/113675-ise-binds-multi-names-00.html
Cisco ISE checks for a matching subject name as follows:
1. Cisco ISE looks at the subject alternative name (SAN) extension of the certificate. If the SAN contains one or more DNS names, then one of the DNS names must match the FQDN of the Cisco ISE node. If a wildcard certificate is used, then the wildcard domain name must match the domain in the Cisco ISE node's FQDN.
2. If there are no DNS names in the SAN, or if the SAN is missing entirely, then the Common Name (CN) in the Subject field of the certificate or the wildcard domain in the Subject field of the certificate must match the FQDN of the node.
3. If no match is found, the certificate is rejected.
Regards,
Jatin Katyal
*Do rate helpful posts*

Add component to cluster

Hi,
I have a cluster X of 6 controls (different types). I have an other one (Y) of 7 indicators. The first 6 of them correspond to the ones of X, and I need to put a numeric constant in the seventh. I did not find any other way than unbundle X, rebundle all its components with a seventh input and wire it to my output cluster Y. Can I jump the unbundle of X step by just adding a component, as, for example, when we build an array with to inputs: 2D array and single column. We don't have to separate each column of the 2D array before adding the other one... Thanks.
Phil

AFAIK, clusters are static structures, but you have other possibilities, e.g.:
* Add the seventh item also to cluster X, but hide it in the display there (right-click..advanced..hide control) or slip it under the border.
* Make the cluster Y as a cluster of [cluster X + indicator #7], this way you don't need to unbundle X.
LabVIEW Champion . Do more with less code and in less time .

Re: Trying to add new harware in cluster

Hello All
I am using a weblogic 9.2 mp1 WL server in production. We have 4 boxes and two instances on each box and admin server on first box as well. we have recently cloned the box 1 and made a replica of that box on two extra boxes. we are planning to add these two boxes into the cluster with two new instances on each box.
we have Node manager in our environment, when i include the two new boxes into the cluster , i got the below error under NodeManager status tab in Monitoring tab of mahcines when i try to monitor whether NM is reachable from WL console.
*"[Security:090504]Certificate chain received from xxx.yyy.s,sb.gov - 10.224.43.52 failed hostname verification check. Certificate contained yyy.xxx.s.sb.gov but check expected xxx.yyy.s,sb.gov .gov**i
I have disabled Host Name verifier in Weblogic console under SSL tab(advanced) for admin server as well as the instances on new boxes inspite of that i am getting the same error.
i got the below error in the node manager logs.
*<Sep 28, 2010 4:07:28 PM CDT> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from yyy.xxx.s.sb.gov .gov - 10.274.**.**. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.>*
I am yet to explicitly include the the new instances from new boxes in the cluster tab of WL console
Can i know a way to solve this problem and include the new servers in the clusters successfully. unfortunately we don't have pre-prod env at our data center to test.
Any inputs will be much appreciated.
Thanks

Other boxes which were already there in the cluster has "Host Name verification" enabled in it.
Infact i tried by doing SecureListener=False in "nodemanager.properties" file and also diabled host name verifier for the instances of new boxes still it din't worked.
I have also copied the config.xml and Demo Trust and Identity keystores from the box(where admin and two instances ofthe cluster lie) to the cloned new box.
Can any one suggest what else can be done?

How to add new Java Instance to cluster in EHP1?

I've installed the EHP1 (Beta 3.0) on a Windows 2003 box, and have figured out how to use the
configtool to add server processes to the initially created Java Instance.
What tool or process do I use to go the next step and add additional Java Instances to the cluster?
Sorry if I've missed where the steps are already described, I've tried to find them.
Walt

Hi Dido. Thanks for your pointer.
When I started the installer, it gave me only the choice of the Developer Edition. Perhaps for this
EHP1 Evaluation Version the Productive Edition is not yet available??
The top line in the installer was "SAP Enhancement Package 1 for SAP NetWeaver CE 7.1 SDN
Evaluation"
The only next choice was "SAP NetWeaver CE Developer Edition"
The two choices under this were "Custom Server Installation" and "Uninstall - SAP Systems or
Single Instances".
Will any of these choices allow me to add an additional Java Instance to the cluster?
Thanks for your help ...
Walt

Lab View crashes when I add element to cluster

Hi guys,
My program is quite large, so I try to explain my core problem. When I add a new element in the cluster called "Summary" it obviously generates an error.
But when I start to run the program, bearing in mind that the program should show me the occured errors, LabView 8.5 crashes.
This cluster has about 160 elements,18 local variables,which are distrubuted in the whole program and its information is used in different SubVi's.
It's strange that my other clusters react normally according to that problem and the program doesn't crash.
What could the problem be?
Cheers, Nobby

Hi Nobby,
what answer do you expect?
All we know is that you named your cluster "Summary". We neither have a vi attached nor the cluster typedef... And you don't give any error description (apart from "it crashes")...
All I can say is: probably you have some overuse of local variables
Best regards,
GerdW
CLAD, using 2009SP1 + LV2011SP1 + LV2014SP1 on WinXP+Win7+cRIO
Kudos are welcome

OIM-SOA CLUSTER add new node

Hi All,
i need to add a new node to my cluster OIM/SOA.
My env is:
1) cluster 6 nodes whit SOA and OIM
2) the first node have a console weblogic server admin
3) More patchs are installed on
Look at this picture: [https://dl.dropboxusercontent.com/u/9054488/OIM-SOA-CLUSTER.jpg]
I found the proc to doc.id [e10106 pag.523 - 8.9.3.20.1 Scaling Up Oracle Identity Manager] but I don't understand if it is applicable to systems already patched.
There is a procedure already proven and clearer?
Thanks.

In order to add a new node, you must first install all the applications/modules in your middleware home. Install the same patches on top of those. Then using the packEnv scripts to pack up the domain, and then unpack it to your new host.
From the weblogic console, use the option to clone your app server and create a new machine for your new machine instance. Startup your node manager on your new machine, and start your app server.
You just need to make sure to do all the same modifications, if you have any, to your new server, like deploy jar files, make changes to UI interface, etc.
-Kevin

Add node to the cluster

Dear Experts,
Please help me, I am new in RAC and I have a question please;
We have 6 nodes cluster of 11.2.0.2.3 version and my manager wants me to add a new node to the cluster.
Could you please send me the steps 1, 2 , 3 ...
we have not shared oracle homes (oracle user), not shared grid homes (grid user) and they are all patched with patch set update 3 (11.2.0.2.3) all under Enterprise Redhat Linux 5.5.
Please also tell me with which system user (oracle, root or grid) I have to run each command...
Could you help me?
S

I have the following errors, could you help me please? (Oracle and grid homes are not shared)
-bash-3.2$ ./addNode.sh "CLUSTER_NEW_NODES={db07}" "CLUSTER_NEW_VIRTUAL_HOSTNAMES={db07-vip}"
Performing pre-checks for node addition
Checking node reachability...
Node reachability check passed from node "db01"
Checking user equivalence...
User equivalence check passed for user "grid"
Checking node connectivity...
Checking hosts config file...
Verification of the hosts config file successful
Check: Node connectivity for interface "bond1"
Node connectivity passed for interface "bond1"
Node connectivity check passed
Checking CRS integrity...
CRS integrity check passed
Checking shared resources...
Checking CRS home location...
ERROR:
PRVF-4864 : Path location check failed for: "/opt/11.2.0/grid"
Shared resources check for node addition failed
Check failed on nodes:
        db07
Checking node connectivity...
Checking hosts config file...
Verification of the hosts config file successful
Check: Node connectivity for interface "bond0"
Node connectivity passed for interface "bond0"
Check: Node connectivity for interface "bond1"
Node connectivity passed for interface "bond1"
Node connectivity check passed
Total memory check passed
Available memory check passed
Swap space check failed
Check failed on nodes:
        db01,db07
Free disk space check failed for "db01:/tmp"
Check failed on nodes:
        db01
Free disk space check failed for "db07:/tmp"
Check failed on nodes:
        db07
Check for multiple users with UID value 501 passed
User existence check passed for "grid"
Run level check passed
Hard limits check passed for "maximum open file descriptors"
Soft limits check passed for "maximum open file descriptors"
Hard limits check passed for "maximum user processes"
Soft limits check passed for "maximum user processes"
System architecture check passed
Kernel version check passed
Kernel parameter check passed for "semmsl"
Kernel parameter check passed for "semmns"
Kernel parameter check passed for "semopm"
Kernel parameter check passed for "semmni"
Kernel parameter check passed for "shmmax"
Kernel parameter check passed for "shmmni"
Kernel parameter check passed for "shmall"
Kernel parameter check passed for "file-max"
Kernel parameter check passed for "ip_local_port_range"
Kernel parameter check passed for "rmem_default"
Kernel parameter check passed for "rmem_max"
Kernel parameter check passed for "wmem_default"
Kernel parameter check passed for "wmem_max"
Kernel parameter check passed for "aio-max-nr"
Package existence check passed for "make-3.81( x86_64)"
Package existence check passed for "binutils-2.17.50.0.6( x86_64)"
Package existence check passed for "gcc-4.1.2 (x86_64)( x86_64)"
Package existence check passed for "libaio-0.3.106 (x86_64)( x86_64)"
Package existence check passed for "glibc-2.5-24 (x86_64)( x86_64)"
Package existence check passed for "compat-libstdc++-33-3.2.3 (x86_64)( x86_64)"
Package existence check passed for "elfutils-libelf-0.125 (x86_64)( x86_64)"
Package existence check passed for "elfutils-libelf-devel-0.125( x86_64)"
Package existence check passed for "glibc-common-2.5( x86_64)"
Package existence check passed for "glibc-devel-2.5 (x86_64)( x86_64)"
Package existence check passed for "glibc-headers-2.5( x86_64)"
Package existence check passed for "gcc-c++-4.1.2 (x86_64)( x86_64)"
Package existence check passed for "libaio-devel-0.3.106 (x86_64)( x86_64)"
Package existence check passed for "libgcc-4.1.2 (x86_64)( x86_64)"
Package existence check passed for "libstdc++-4.1.2 (x86_64)( x86_64)"
Package existence check passed for "libstdc++-devel-4.1.2 (x86_64)( x86_64)"
Package existence check passed for "sysstat-7.0.2( x86_64)"
Package existence check passed for "ksh-20060214( x86_64)"
Check for multiple users with UID value 0 passed
Current group ID check passed
Checking OCR integrity...
OCR integrity check passed
Checking Oracle Cluster Voting Disk configuration...
Oracle Cluster Voting Disk configuration check passed
Time zone consistency check passed
Starting Clock synchronization checks using Network Time Protocol(NTP)...
NTP Configuration file check started...
NTP Configuration file check passed
Checking daemon liveness...
Liveness check passed for "ntpd"
Check for NTP daemon or service alive passed on all nodes
NTP daemon slewing option check passed
NTP daemon's boot time configuration check for slewing option passed
NTP common Time Server Check started...
Check of common NTP Time Server passed
Clock time offset check from NTP Time Server started...
PRVF-5413 : Node "db01" has a time offset of -165613.0 that is beyond permissible limit of 1000.0 from NTP Time Server "192.168.248.253"
PRVF-5413 : Node "db07" has a time offset of -161593.0 that is beyond permissible limit of 1000.0 from NTP Time Server "192.168.248.253"
PRVF-5424 : Clock time offset check failed
Clock synchronization check using Network Time Protocol(NTP) failed
User "grid" is not part of "root" group. Check passed
Checking consistency of file "/etc/resolv.conf" across nodes
File "/etc/resolv.conf" does not have both domain and search entries defined
domain entry in file "/etc/resolv.conf" is consistent across nodes
search entry in file "/etc/resolv.conf" is consistent across nodes
All nodes have one search entry defined in file "/etc/resolv.conf"
The DNS response time for an unreachable node is within acceptable limit on all nodes
File "/etc/resolv.conf" is consistent across nodes
Checking VIP configuration.
Checking VIP Subnet configuration.
Check for VIP Subnet configuration passed.
Checking VIP reachability
Check for VIP reachability passed.
Pre-check for node addition was unsuccessful on all the nodes.
-bash-3.2$

WLC, ISE certificate authentication issue

Hi Folks,
This is the setup:
Redundant pair of WLC 5508 (version 7.5.102.0)
Redundant Pair of ISE (Version 1.2.0.899)
     The ISE servers are connected to the corporate Active Directory (the AD servers are configured as external identity sources)
     There is a rule based authentication profile which queries the AD identity source when it receives wireless 802.1x authentication requests.
A corporate WLAN is configured on the WLC:
L2 security WPA+WPA2 (AES Encryption), ISE server 1 and 2 configured as the AAA Authentication servers.
This is all working correctly - I associate to the Corp WLAN (Authentication WPA2 enterprise, encryption AES CCMP, 802.1x auth MS-CHAPv2 using AD credentials) ... I can see the authentication request being processed correctly by the ISE, and I get access to the network.
The client I am working for wants to restrict access to the WLAN to users who have been allocated a certificate from the corporate CA, and this is where I am having issues.
I took a test laptop, and requested a new certificate (mmc, add snapin, certificates, current user, personal, request new cert).
The cert that was issued was signed only by a Corporate AD server with CA services (there is nothing in the certification path above the cert I was issued, apart from the issuing server itself).   I changed the security settings of my connection to the corp wlan (using TLS instead of mschapv2, and pointing to the certificate I requested)
Initally authentication failed because the ISE did not trust the CA that provided my certificate (the ISE radius authentication troubleshooting tool had this entry: '12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain').
I exported the issuing CA's root certificate (followed this process http://support.microsoft.com/kb/555252), and imported the cert into ISE (administration, system, certificates, certificate store, import) - status of the cert is enabled, and it is trusted for client auth.
After I did this, I could no longer associate to the Corp WLAN.
My laptop's wireless management software logs were filled with messages saying that the authentication server did not respond.
The ISE troubleshooting tool reported no new failed or successful authentication attempts.
Strangely though, the WLC log had a lot of entries like this: 'AAA Authentication Failure for UserName:host/laptop_asset_tag.corp.com User Type: WLAN USER'.
It looks like the WLC is trying to locally authenticate my session when I use TLS, rather than hand off the authentication request to the ISE.    Other users who authenticate using their AD credentials only (as I described above) can still authenticate ok.
Anyone able to shed some light on where I have gone wrong or what additional troubleshooting I can do?
Thanks in advance,
Darragh

Hi,
I had the same issue with microsoft CA and running ISE 1.1.4. The CA file was "corrupted", but you didn't see it at first glance. You can verify if the client CA matches the root CA via openssl.
Try to export the root CA and the issuing CA in a different format (Base64), import both root and issuing into ise and check if that works. Also check if "Trust for client authentication or Secure Syslog services" in the Certificate Store -> CA -> Edit, is set.
If this does not work, try to import the CA into another system and export it, then import into ISE.
Regards,

Main Front Panel Cluster reference in Sub VI

If I create a reference to a cluster and then create a Sub Vi, I can change
the cluster variables from the sub vi. All works well - Until I modify the Cluster.
This breaks the sub vi with a wire class error. Can I fix this ???
Solved!
Go to Solution.

Hi Ben,
You got a broken wire just because you used a property node for strict type definitions (not for generic). The VALUE of the property node that you used includes the information of cluster data type.
My suggestion is to use a type def cluster, and use this cluster constant for "Variant to Data" in subVI. By using this type def cluster, you do not need to modify the main part of your subVI. You only need to change the unbundle item when you add/remove new element of the cluster.
Attachments:
LV Ref.zip ‏18 KB

Cluster setup

          Hi,
          I'm running two WLS 6 in a multihomed machine. Do I need to install to instances
          of WLS or can I install one instance and use the same file, but starting with
          different scripts. Are there any negatives or positives about using one install,
          but two scripts? These instances will be clustered.
          Thanks for your help.


          But do I have to have the same installation or I can have different
          installations?
          Should the clusters use the same config.xml files?
          Also, am I correct to assume that the admin server can also be a cluster?
          I have only two machines and I want one of them to be the admin, as well as
          to be one of the nodes in the cluster. Is there anything wrong with this
          configuration?
          Thanks.
          Andre Mendonca
          [email protected]
          "Kaye Wilcox" <[email protected]> wrote in message
          news:[email protected]...
          > You'll need to create your cluster and add your server instances to the
          > cluster via the console (see
          > http://edocs.bea.com/wls/docs60/adminguide/config.html#1024476).
          >
          > You'll need only one WLS 6.0 installation on your machine. You will need a
          > start up script for each server instance that you want to boot up. So if
          you have
          > an admin server and a cluster of two managed servers you will need three
          start up
          > scripts for your servers (see
          <WL_HOME>/wlserver6.0/config/mydomain/startWebLogic.sh
          >
          > and startManagedWebLogic.sh for example start up scripts).
          >
          > wwen wrote:
          >
          > > Hi,
          > >
          > > I'm running two WLS 6 in a multihomed machine. Do I need to install to
          instances
          > > of WLS or can I install one instance and use the same file, but starting
          with
          > > different scripts. Are there any negatives or positives about using one
          install,
          > > but two scripts? These instances will be clustered.
          > >
          > > Thanks for your help.
          >

Add ISE 1.3 in a cluster of ISE 1.2

Similar Messages

Maybe you are looking for