Cisco ISE deregister node not available

Hello,
I installed two ISE node and registered the second node. Yesterday I saw an error message: Sync failed, deregister and register the second node.
I deregistered the second node and tried register again, but not worked. Now, the second node is showing in the first node but I can not deregister or register again, how I can deregister the second node to register again?

This seems to be an issue with invalid certificates. Have you already checked the certificates on both the sides. Also restart the services of secondary nodes one and check again.
As a next step, we need to look inside ise-psc.logs to further troubleshoot this issue.
Regards,
Jatin Katyal
**Do rate helpful posts**

Similar Messages

Hierarchy node not available in Query Designer

Hello Gurus,
I can find the hierarchy node variable in BW but it is not available in query designer. Does anyone know what might be the problem and a solution?
Thanks,
Mark

Hi Mark,
You said you "find the hierarchy node variable in BW but it is not available in query designer".
How did you find the hierarchy node variable in BW? From backend SAPGUI, you will only be able to see the variable in some internal tables like RSZGLOBV. Did you mean this?
For "it is not available in query designer", do you means that when you want to create a hierarchy node variable for this characteristic in Query Designer, you don't find this certain hierarchy node variable in the hierarchy node variable list?
Important thing to notice is that, flat value variables and hierarchy node variables are listed separately. Did you make sure that you have chose to list hierarchy node variables in Query Designer?
Regards,
Patricia

Cisco ISE IP Renewal not working

Hi all,
I am setting up a CWA with Cisco ISE to authenticate Guests and Employees by Web and assign them to Two different vlans. The authentication pass. The authZ Profiles are affected. but The IP address did not change according to vlan until I renew it manually from console ( >ipconfig /release >ipconfig /renew). I desactivated Java in browsers, I activated it again and added the IP of the ISE to the Exception List in Java setting but the IP address still not change automatically.
Any Ideas how to fix this Issue?
Thank you.

Hi Bouchaib,
Make sure you have put a check on the VLAN DHCP Release option.
If you are using ISE 1.3 then your path will be,
Guest Access > Configure > Guest Portals > Create, Edit or Duplicate > Portal Behavior and Flow Settings > VLAN DHCP Release Page Settings.
This affects the Central WebAuth (CWA) flow during final authorization when the network access changes the guest VLAN to a new VLAN. The guest’s old IP address must be released before the VLAN change and a new guest IP address must be requested through DHCP once the new VLAN access is in place. The IP address release renew operation varies by the browser and operating system used; Internet Explorer uses ActiveX controls, and Firefox and Google Chrome use Java applets. For non-Internet Explorer browsers, Java must be installed and enabled on the browser.
The VLAN DHCP Release option does not work on mobile devices. Instead, guests are requested to manually reset the IP address. This method varies by devices. For example, on Apple iOS devices, guests can select the Wi-Fi network and click the Renew Lease button.
For ISE 1.2 version, you can find the same option on the Guest Portal settings.

Cisco Presence Server 8.5 Application - Cisco Jabber menu option not available

                   Dear Support,
                   I am trying to configure cisco jabber with Presence Server 8.5. All the documentation indicate that jabber option in Presence must be configured in the Application -> Cisco Jabber menu, however this menu option is not available in my Presence Server. Anyone know why this is happening? I am using CUCM version 8.6.1. I installed the jabber client for windows in two Windows 7 machines and I have presence and IM funcitonalities but I can not make calls or activate other features like video, desktop sharing and so on.
                    Any help would be really appreciated.
                    Best Regards,
                    Roberto López.

Thanks a lot for pointing me to the right direction.
Just one more question. After installing jabber for windows on a couple of laptops and signing in, the call option (right click on contact or telephone icon located right to the contact) is not available right away meaning that I have to wait a long time for it to appear or if I start a call from the "search or enter number to call" field then all call button and options are enabled. Do you have any idea why this could be happening?
Best Regards,
Roberto.

DAQmx buffer property node not available

The following question was posted to the 'Multifunction DAQ' forum.
Since I received no respones, I'm trying it here:
I transferred an intact VI from a desktop
PC to a laptop.
On the laptop, however, the VI does not compile since the
property node "DAQmx Buffer" is not available. I suspect that I maybe
did not install the full DAQmx suite on the laptop but I don't know
which part might be missing.
(On both machines there is no DAQ hardware installed since I was just trying to do some editing.)
Is my suspicion correct? and how do I find out what's missing'?
If my suspicion is not correct: what else could it be?
TIA
Franz

If I can guess you should check which versions of daqmx are installed on both machines!
Ton
Free Code Capture Tool! Version 2.1.3 with comments, web-upload, back-save and snippets!
Nederlandse LabVIEW user groep www.lvug.nl
My LabVIEW Ideas
LabVIEW, programming like it should be!

Cisco ISE Monitoring node backup size

Hello All,
We have a HA pair of ISE servers that have scheduled backups configured for the Admin persona (currently full weekly backup) and monitoring which is full weekly but with the addtional incremental daily backups. I've not seen any issue with the full weekly backup of the admin node however the monitor one provides unusual results in terms of file size between weekly and incremental backups.
Given the fact that we are currently piloting this with very little radius activity i'm curious as to how the daily backups can be bigger in filesize than the weekly?
The ISE is a ISE-3315-K9 running 1.1.3.124 and below are some examples
-rw-r--r-- 1 tsmbackup tsmbackup 502960384 Apr 21 07:08 mntincr_1_<removed>.tar.gpg (Incremental backup)
-rw-r--r-- 1 tsmbackup tsmbackup 459348307 Apr 21 01:04 mntdbfull_<removed>.tar.gpg (Full backup)
Thanks in advance for any suggestions.
M

Hi,
This could possibly due to ‘Data Purging’. When a purge operation triggers, if the actual used database disk space is greater than the configured threshold, the purge operation removes all data from the Monitoring database tables prior to the data retention window.
Following link might help in your case,
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1074687

Deffered tax node not available in General Ledger Accounting

Hello,
I want to custumize deffered tax programme but the node
:General Ledger Accounting  Business Transactions  Report  Sales/Purchases Tax Returns  Deferred Taxes
is not availabe.
Please suggest what steps are needed to make it available.
ours is ECC 6.0.
Regards
Tushar

Hello,
You might check following path:
Financial Accounting (NOT NEW)
General Ledger Accounting
Business Transactions
    Closing
     Report
      Sales/Purchases Tax Returns
        Deferred taxes
Best regards

Cisco ISE - Authentication Bullet Not Appearing on a Starting Windows Machine Connected to IP Phone

Dears,
I have this case and I would be very thankful if someone has the answer for !
When Wired AutoConfig service is enabled on a Windows XP (or 7) station that is connected to an IP phone, the "Additional Information is needed to connect to this network" popup bullet successfully appears when the UTP cable is unplugged and then plugged back in the network card or the network adapter is disabled and re-enabled or the switchport configured with Dot1x had a shut no shut.
However, the "Additional Information is needed to connect to this network" does not appear when the Windows workstation reboots and it gets unauthenticated!
Our customer finds it a hard task to instruct his "non IT employees" to unplug the UTP cable and then plug it back or do any of the above methods in order for the authentication bullet to appear.
Does anyone know how to configure the Windows machine so that the authentication popup bullet automatically appears upon machine startup?
Best Regards,

Hello Neno,
I am using PEAP and below is the dot1x config under the switchport:
interface GigabitEthernet0/4
switchport access vlan 107
switchport mode access
switchport voice vlan 156
authentication event server dead action authorize vlan 107
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout quiet-period 180
spanning-tree portfast
Please note that the authentication bullet appears on a Windows PC directly connected to the switch.
The problem is when the PC is connected to an IP phone or takes too long to boot.

Cisco ISE 1.1 and IE9

Is anyone else having problems with ISE admin/monitoring pages not working properly under IE9? I just completed an upgrade to ISE 1.1, and it seems more and more, when I try to manage the system with IE9, I will get the following error (host name changed to protect the inocent). I dont know if this is truly an IE9 issue, or the chrome plug-in we are forced to use. Works perfect under Firefox 11.0.
This webpage is not available
The webpage at https://iseserver.domain.com/mnt/pages/dashboard/dashboard.jsp?mnt_config_write=true&token=BEGIN_TOKENXspmm4x5AwFsV6NExIBAVA==END_TOKEN might be temporarily down or it may have moved permanently to a new web address.
Error 103 (net::ERR_CONNECTION_ABORTED): Unknown error.

Supported Administrative User Interface Browsers
You can access the Cisco ISE administrative user interface using the following browsers:
•Mozilla Firefox 3.6 (applicable for Windows, Mac OS X, and Linux-based operating systems)
•Mozilla FireFox 9 (applicable for Windows, Mac OS X, and Linux-based operating systems)
•Windows Internet Explorer 8
•Windows Internet Explorer 9 (in Internet Explorer 8 compatibility mode)
Cisco ISE GUI is not supported on Internet Explorer version 8 running in Internet Explorer 7 compatibility mode. For a collection of known issues regarding Windows Internet Explorer 8, see the "Known Issues" section of the Release Notes for the Cisco Identity Services Engine, Release 1.1.

Cisco ISE managing configuration

Is there a built-in mechansim for revision control in Cisco ISE? If not built-in, then what is the other way? I have been trying to look for documentation online but didn't find any.
Just to explain what I am looking for:
A way to properly manage all the configuration changes to ISE node. Changes are usually identified by a number or letter code, termed the "revision number". For example, an initial set of files is "revision 1". When the first change is made, the resulting set is "revision 2", and so on. Each revision is associated with a timestamp and the person making the change. Revisions can be compared, restored, and with some types of files, merged.
I ask this because "show run" output in ISE CLI does not give all the configuration details. How can we maintain the history of configurations?
PS: I rate useful posts
Thanks,
Kashish

There is not a way to track which version a specific ISE configuration is on. The ADE-OS configuration, or cli configuration typically is static once the repositories, dns info...etc is all set and done. For the application database you can setup a timer where an automatic backup is generated, from there you can manage what dates a backup is good for.
Thanks,
Tarik Admani
*Please rate helpful posts*

Guest Activity on Cisco ISE

Is it possible to monitor the web pages visited for a guest using cisco ISE?

Hi Gino,
Yes, you can use the Guest Activity option. The Guest Activity report provides details about the websites that guest users are visiting. You can use this report for security auditing purposes to demonstrate when guest users accessed the network and what they did on it.
This report is available at: Operations > Reports > Endpoints and Users > Guest Activity.
To use this report you must first:
•Enable the passed authentications logging category. Choose Administration > Logging > Logging Categories and select Passed authentications.
•Enable these options on the firewall used for guest traffic:
–Inspect HTTP traffic and send data to Cisco ISE Monitoring node. Cisco ISE only requires the the IP address and accessed URL for the Guest Activity report so, if possible, limit the data to include just this information.
–Send syslogs to Cisco ISE Monitoring node
Please check the below link for further information,
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_guest_pol.html#wp1056645

Ise node not becoming standalone after deregistration

I am seeing a weird problem.
I deregistered secondary admin/monitor node from primary admin/monitor node. I see successfully deregistered message.
But the deregistered node is still showing SEC(A) and SEC(M). It is not changing to standalone mode.
This is disrupting the upgrade of distributed deployment of ISE nodes.
Any clues?

Bug details:
Secondary node never becomes standalone after de-registration
The secondary node is de-registered successfully but a "The following deregistered nodes are not currently reachable: . Be sure to reset the configuration on these nodes manually, as they may not revert to Standalone on their own." message appears to the administrator.
Workaround Log in to the administrator user interface with internal Cisco ISE administrator credentials when de-registering a node.
Actually we had two accounts in web gui, nodes were registered using one account and during upgrade, i used different account , which triggered this bug.

Cisco ISE in High Availability mode

Hello
Need some help, I have hardware cisco ISE 3315, want to go for high availability now, my question is that;
1. Is Cisco ISE available on Hyper V ?
2. Is it possible to configure 1 hardware , and other virtual (VMware / HyperV {If available}) in high availability mode ?
Thank you very much.

While ISE may run in Hyper-V, it will definitely not be supported so I recommend staying away from doing that. The only supported virtual environment is VMware. If you only have Hyper-V then you will have to get another appliance. Do keep in mind that the 3315s are EOL/EOS. The replacement models for those are the 3415.
As it was already stated above Charles and Karsten, you can mix virtual and physical appliances. So if you do en up going with a supported virtual solution make sure that the resources for the ISE nodes are dedicated/reserved and that thin provisioning is also NOT supported.
Hope this helps!
Thank you for rating helpful posts!

ISE 1.1.3.124 secondary node not reachable after registration

G'day All,
I'm constantly seeing that the sync and replication status for my secondary admin/monitor node in the primary node as node not reachable. The secondary still thinks it is in standalone mode. When I run the ISE diag tool connectivity tests I am able successfully ping the devices from each other using both hostname and ip and the nslookup also works fine between both nodes. Ping and nslookups also work from different networks within the environment. The two nodes are in the same vlan on a 6500 vss pair but on different switches of the pair. I'm new to ISE so any help is greatly appreciated.
Thanks All.
JS
Sent from Cisco Technical Support iPhone App

Hi Saurav,
Thanks for your prompt repsonse...
I have worked through that section of the document. The registration completes successfully, I've got NTP sync on both nodes and the system time on both nodes is identical.
I am only using the self signed certificates, but following the user guide instructions I have imported the secondary's cert into the primary node.
Just as of about 30 minutes ago, I saw an alarm on the Secondary ISE node stating that a Slow or Stuck Replication has been detected...
As I said in the original post, I can ping the fqdn's from each other so it appears that the DNS requirements have been satisfied.
I've changed the admin account password, I am certain that the ISE DB passwords are correct and the same on both nodes and the timezones for both nodes is the same also....
It looks to me that registration is fine, but the first full replication isn't completing successfully
Thanks,
JS

NODE-NOT-REACHABLE on ISE

Primary ISE node (Serving Admin and Monitor personas) is showing two of the PSNs as "NODE-NOT-REACHABLE" under Replication Status on Deployment page on GUI. It can ping the PSNs and PSNs are actually registered to the Primary admin/monitor node. How can I fix this?
Thanks,
Kashish

Hi,
I found the issue on ny network and it was due to a different dns record.
Simple way to check is issuing a dns lookup from admin node cli of the problem node. Then repeat from problem node attempting to resolve admin node.
Then if that looks good you can issue the command on both nodes...
Show logging application ise tail,
That output should give you a listing of the nodes in the ise deployment and the ip addresses of each node.
Thanks.
Sent from Cisco Technical Support Android App

Cisco ISE deregister node not available

Similar Messages

Maybe you are looking for