Broken ISE deployment

Hi all,
I need to change the IP addresses in an ISE 1.2 HA deployment (a primary/secondary pair). The tricky part is that the deployment was broken before I could get my hands on the servers.
I can make the primary server stand alone, and perform the address change, but for the secondary server I do not seem to have that option.
So what is the proper procedure to be able to reconfigure the IP address of a "broken" secondary server?
Thanks,
Lennart

Hi Walfors,
The good part here is that you are able to successfully make your Primary node as standalone. You can take the backup of this standalone node to be on safer side.
Normally when you perform the deregister operation from Primary ISE node, then the secondary node will be turned to standalone and you will be having a safe standalone node.
As you are saying that your secondary node even after de-registering from primary it is still in Secondary mode and you cannot do any operations to this Secondary node.
If you are having concern about the certificates then I would recommend to take the backup of certificates by logging into secondary node GUI and go to Administration -->Server Certificates -->Click on the certificate you want to export and then click on export button.
Now you are good to perform the reset-config operation on your secondary ISE node. Go to CLI and trigger the command "application reset-config ise ". This command will reset all your exisiting data with the default data .
Once after succesful completion of reset-config operation then if required you can restore the certificates that were exported and then join this node back to the deployment.
This way is the clean setup process.
If you do not want to perform the reset-config operation and need to be debugged further why the deployment is broken I would suggest you to raise service request with TAC .

Similar Messages

Cisco ISE Deployment suggestion required

Require Assistance on Cisco ISE Deployment for below scenario
-- We have Three Cisco ISE Appliances and Client has taken Advance Subscription License for 500 users
-- Client has DC & DR and needs to deploy the Cisco ISE in one Main Office which connects to DC & DR on MPLS Links
-- Client suggestion was to deploy one ISE node ( Admin + M&T + Policy Server ) in DC and its Standby Secondary in DR
     and only deploy Policy Server in Main Office.
     Idea behind the design is that ,
     1) If DC fails , Cisco ISE related logs will get generated on DR and any Cisco ISE related request will be taken care by Local Policy Server in Main Office .
      2) If Local Policy Server Fails , then ISE node in DC will act as Secondary backup and DR will act Teritary Backup
      below is view
                                     DC
                        Primary Node with Role
                   [Admin , M&T , Policy Server]
                                                                                                             Main Remote Offic
                                                                                                              Cisco ISE Node ( Only Policy Server) -----------> Network Devices
                               DR
                       Secondary   Node with Role
                   [Admin , M&T , Policy Server]
Please let me know is it possible

Yes, The scenario is quite achievable also please review the below link for assistance on deployment of ISE.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.pdf

ISE Deployment - Limit on Radius Sources?

Greetings,
I am planning a change to our ISE deployment, and I am curious if there is a limitation to the number of Radius sources that can be added to the running config on the switches and APs.
The majority of the switches are 2960 series and the APs are 2602 models.
Currently, we have two Radius Sources configured as follows:
aaa group server radius rad_eap
server X.X.X.X auth-port 1645 acct-port 1646
server X.X.X.X auth-port 1645 acct-port 1646
I need to know if I am able to add a third entry to that list, or if there is a hard limitation I am unaware of.
Thank You.

ISE questions will probably get more traction in the Security forum.
That said, the answer is "it depends". It all depends on your design. Is your third server a Policy Services Node or an Inline Posture Node (IPEP)? Either way, one of those would generally be positioned so as to provide profiling, posture and enforcement services working in conjunction with the Admin server(s). If a server is not part of the overall architecture, it will not.
All new ISE designs should be based on the Cisco-approved High Level Design (HLD) template. If you follow that and develop your Low Level design based on it, many of the typical questions should be answered.
Hope this helps.

Report Generation broken after deployment - Excel Set Cell Color and Border.vi

Upon deployment, the Excel Set Cell Color and Border.vi became broken. After installing LV2010 SP1 to view the VIs in the deployment, I noticed that in the second case structure where the code draws the border using the BorderAround invoke node, there is an extra variant input parameter named 'Parameters'. Upon right-clicking, an option to 'Relink Invoke Node' appeared and after selecting this, the extra input disappeared and the VI was no longer broken.
Why does "Relink Invoke Node" appear? How do I create a deployment with this issue? Has anybody else experienced this? Why is the TestStand deployment so buggy?

Hi Ching-Hwa,
I have set up a test deployment here where I am deploying a workspace that contains a sequence file. This sequence file has a LabVIEW Action Step calling a VI that opens a new Excel file and simply calls the Excel Set Cell Color and Border VI. After deploying this, both the VI and my test sequence ran on the deployment machine without error. Therefore, I do have some more questions to more accurately reproduce what you are seeing.
First, what operating systems are you developing on and deploying to? Also, what license do you have for TestStand on the machine you are deploying to? If you have a development version, can you manually take the sequence file and VI to this machine and run it? I know you now have LabVIEW 2010 SP1 on your development machine, but if you have the development version of TestStand as well, it would be interesting to see if you copy the files over if you still see this behavior. Are you including the TestStand Engine in the deployment?
Can you open a blank VI on the deployment machine and add the Excel Set Cell Color and Border VI? It would also be interesting to see if this is not a product of the deployment, but rather an issue with something on the deployment machine itself. What version of the Report Generation Toolkit do you have on each machine? Also, what versions of Excel are you using on the development and deployment machine? Again, it would be helpful for me to know exactly what versions you have installed on both the development and deployment machines so that I can reproduce this as accurately as possible.
One last thing to try, too, would be to try deploying the VI by itself just to see if it also has the same behavior. Do you have the Application Builder in LabVIEW? If so, could you also try building an executable from the VI, create an installer, and deploy this to the deployment machine?
In regards to the "freezing" of code by removing the block diagrams, I do not believe this will be a proper work around in this case. While this removes the block diagram from actually being deployed along with the VI and restricts users from editing the code on the deployment machine, if something is getting changed in the compiled code upon deployment, this will not stop this from happening. This option is available more as a memory option to lower the size of the deployment as well as prohibit any users on the development machine from editing the block diagram themselves.
Thanks, Ching-Hwa! I look forward to your response so that I can continue trying to reproduce this issue. Have a great day!
Taylor G.
Product Support Engineer
National Instruments
www.ni.com/support

Cisco ISE Deployment

Dears,
We have 2 ISE server. I configured wired, wireless,vpn, guest user authentication from ISE server. All of them are normal working. Both of ISE server have same Image.(ver 1.2) I deployed ISE servers as HA. I register second ISE server at primary ISE server. I attached the configuration files.
I want one ISE device is primary( Administration, Monitoring and Policy are active in primary ISE) and the other ISE server is backup or standby. (Administration, Monitoring and Policy are standby). When the Primary ISE server is going to down then all AAA process is going through the secondary ISE server( it is like redundancy on ASA)
Is it possible to configure? If yes how I do this configuration?
Thank for your helping.

ISE 1.2 does not have an Automatic Failover for the Admin Nodes. If the primary node goes down, you have to manually promote the secondary node.
Until you promote the secondary, the deployment has very serious limitations:
So, you see, there is no true HA with Automatic Failover for ISE 1.2.You have to have both ISE servers on anyway and the Monitoring Persona is the only one that does support Automatic Failover, so it really does make sense to deploy your nodes as noted here:
Node1: Admin (Primary), Monitoring (Secondary), Policy Service
Node2: Admin (Secondary), Monitoring (Primary), Policy Service
The notes I referenced can be found in the ISE 1.2 User Guide.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE Deployment Problem

I have two Cisco ISE in my infrastructure with a two-node deployment. Due to some problems, the secondary node was disconnected. When was reconnected the node the license had expired.
I tried to perform a resync, but the option was disabled. I tried to make a deregister and then register a new one, when I tried this procedure, I received the message that the Node is not a standalone node.
Now, when I try to access the ISE secondary, I get the message must update the license, so I can not reconfigure the system.
What do you recommend I do?

Try deregister and then register
Check the Current Licenses in both primary and secondary nodes. They should be sync
To view current license in Cisco ISE, choose Administration > System > Licensing > Current Licenses. The Current License page appears, which contains the following information:Administration Node,ID—Administration node ID ,Version, Type, Expires, Licensed To, Base, Advanced
For out of sync issues, which most likely are due to time changes or NTP sync
issues, you must correct the system time and perform a manual sync up through
the UI.
For certificate expiry issues, you must install a valid certificate and perform a
manual sync up through the UI

ISE deployment in wireless infra without WLC (only Access Point 1240AG)

Hello All,
I am having access point 1240AG and planning to deploy ISE as a exteral radius server. I would like to know how deifferent authorization policy need to configure in AP/ISE. Whether I can use named ACL or VLANs (CoA) as a enforcement types without use of WLC. If yes then how?
Thanks in advance.

Hi,
You can perform COA on standalone APs you will need to have an inline posture node in order to reap the benefits of COA, you may have heard this from any vpn related deployments. If you are in the design phase of this project, you may want to purse controllers because the latest rumor is that the inline posture node may be dropped since Cisco is planning on supporting coa on all their devices once the 9.x code drops for the ASAs. However please contact your Cisco rep for an official response.
Here is the footnote in the following link: "Autonomous AP deployments (no WLC) also require deployment of an Inline Posture Node for posture support."
http://www.cisco.com/en/US/docs/security/ise/1.1/compatibility/ise_sdt.html#wp55038
Thanks,
Tarik admani

Cisco ISE Deployment issue

Hi dears,
I deployed the ISE primary and secondary mode. Then I did deregister the secondary ISE at Primary ISE. Now i want to register the same second ISE as secondary mode on Primary ISE. but this error occur:
Unable to register SecondaryISE. Node is not a Standalone node.
I connect the secondary ISE and see deployement personas
Administration: Secondary
Monitoring: Secondary
Then I did promote to primary command after that ISE is log out but the problem is not solve.
version 1.20.8xx of both ISE's
How i solve this issue?
Thanks

try by promoting the secondary ISE which you have de-registered to standlone and try registering it on primary now

Cisco VM server based ISE deployment in out of Band

Hi,
can any one please share the link of Configuration guide for VM based Cisco ISE in out of band deployment model.
Regards,
Awais

Hi,
can any one please share the link of Configuration guide for VM based Cisco ISE in out of band deployment model.
Regards,
Awais

Manually Patch Cisco ISE Deployment

Is there a documented process for manually installing patch bundles in ISE? We had a bad experience last spring with deploying Patch 8 through the "fire and forget" patch installation through the GUI. We have held off far too long on patching our 20 node deployment and I will be asked whether the process failure was due to Patch 8, or whether the patching process itself failed. Please let me know if there is a procedure on how one would go about manually patching a deployment via the CLI.
Thank you

install a patch from a primary administration node that is part of a distributed deployment, Cisco ISE installs the patch on the primary node and then all the secondary nodes in the deployment. If the patch installation is successful on the primary node, Cisco ISE then continues patch installation on the secondary nodes. If it fails on the primary node, the installation does not proceed to the secondary nodes. However, if the installation fails on any of the secondary nodes for any reason, it still continues with the next secondary node in your deployment. Secondary Cisco ISE nodes are restarted consecutively after the patch is installed on those nodes. While installing a patch on secondary nodes, you can continue to perform tasks on the primary administration node.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/cli_ref_guide/ise_cli/ise_cli_app_a.html#pgfId-2476373

ISE Deployment - Your Feedback

Hi,
I am currently evaluating two NAC systems: ISE and Bradford and I wanted to see if anyone has had the opportunity to see both systems. Although we are a Cisco shop, I am looking for simplicity due to staff shortage.
In the event I decide to go with ISE, I would like to hear your personal challenges with the product during the deployment phase and those little things I need to keep in mind to avoid future headaches.
Thanks in advance !

Hello,
I have one done (not finished) one deployment with 150 clients. And one guy I know is doing a very large scale deployment.
To me it's very interesting but very challenging. I really under estimated the time it would take. I did this project because my client wanted it. From a technical point of view it's very positive for me, from a financial point of view it's really bad as I've spent a lot of time.
The client is so far very happy although some implemented features are missing.
I would recommend to start with Wifi only and once you understand ISE and know how to troubleshoot make Wire to work. I have not tried remote access though.
Some hints:
- You're full Cisco or you have other vendors (I'm thinking about IP Phones but the question can also be asked for switches and wlc)
- You have a PKI or not.
- You have devices (endpoints) and they are not 802.1X capable. All of us have, but the important is to list them.
It's also difficult because it involves a lot of components and protocols:
- Components: The radius server (ISE), the NAS (Switch or WLC), the endpoints (PC, APs, printers), the host (in my case VMWare)
- Protocols: EAP protocols, Snmp/DHCP for profiling, Wifi etc.
So I wouldn't see a guy with a little experience in networking dealing with something like this. I was more than familiar with many of these things. And before ISE I also tried Freeradius and made is work with Wifi and Vlan assignement and a LDAP server.
If by chance I make the whole thing to work I need to give the skills to someone else to do a troubleshooting.
So this is my experience so far. Some other have much more experience of course.

ISE Deployment Change..

Hello..
We have 2x3355 ISE appliances and we already deployed them in standalone mode (redundant deployment which support up to 2000 endpoints), After a while the customer ask us to add another PSN using external server with VM version of ISE, he said that 2000 endpoints is not enough for him and he wants to increase the number of endpoints by adding extra PSN.
What I understand is with the current setup (standalone) I cannot add extra PSN unless I re-dpoly the whole thing in distributed mode (which will cause reconfiguring the two appliances and disconnect all ISE services), is this correct? If so Is there any way or guide line to safely migrate from stand alone to distribution without down time..
Thx

Once you convert from Standalone to Distributed Mode, the ISE services MUST restart. There is no getting around this. This generally does not take more than 15 minutes, depending on your environment. Once that is done, you can add PSNs to the deployment without an interruption in service. Just do not remove the Policy Service role from the Admin Node until your PSN is up.

ISE deployment

Hi guys.
Im trying to setup two cisco ise appliances. Primary and Seconadary. Everything is fine. I import the self signed cert from the secodary to primary and life is good.
But... I though if i make the secondary node PRIMARY only for MONITORING it would be better for cpu and all that. When i do that and go to DAsh Board i get an error saying untrusted cuz secondary node has a self signed cert. it wont let me see the dash board. Anyone had this problem?!?
I do not have a CA cert. maybe if i use verisign or godaddy certs this would work. We have those spare and they are cheap and those certs would help for clients not to see the continue anyway stuff and so on
Sent from Cisco Technical Support iPhone App

The versign cert is a good idea to go with. Just remember that ISE does not support wildcard certificates so you will have to generate a CSR from ISE and will need it signed.
Here is a sample of how to create a CSR - http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_man_cert.html#wp1077292
thanks,
Tarik Admani
*Please rate helpful posts*

F5 and Cisco ISE Deployment Guide

Its out! For those of you have been asking and looking for this document as much as I have, it looks like Craig Hyps has delivered! Thank Craig!
http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-95-Cisco_and_F5_Deployment_Guide-ISE_Load_Balancing_Using_BIG-IP_DF.pdf

Cool, thanks for the link! That's exacly what I was looking for. Since 1.2 LB configurations not necessarily also work in 1.3, which I expirienced.

Cisco ISE deployment with HP Swithes

Is there any compatibility matrix of cisco ISE with HP access swithes or there is any features restriction on HP access layer. The HP switches do support 802.1x.
Thanks
Qasim

Qasim,
The only compatibility with network access devices is all related to Cisco gear. It would be best to stick with a full supported solution for the sake of support. In my opinion this will be a nightmare to manage if an issue was to occur.
Thanks,
Tarik Admani
*Please rate helpful posts*

Broken ISE deployment

Similar Messages

Maybe you are looking for