ISE 1.1.3.124 secondary node not reachable after registration

G'day All,
I'm constantly seeing that the sync and replication status for my secondary admin/monitor node in the primary node as node not reachable. The secondary still thinks it is in standalone mode. When I run the ISE diag tool connectivity tests I am able successfully ping the devices from each other using both hostname and ip and the nslookup also works fine between both nodes. Ping and nslookups also work from different networks within the environment. The two nodes are in the same vlan on a 6500 vss pair but on different switches of the pair. I'm new to ISE so any help is greatly appreciated.
Thanks All.
JS
Sent from Cisco Technical Support iPhone App

Hi Saurav,
Thanks for your prompt repsonse...
I have worked through that section of the document. The registration completes successfully, I've got NTP sync on both nodes and the system time on both nodes is identical.
I am only using the self signed certificates, but following the user guide instructions I have imported the secondary's cert into the primary node.
Just as of about 30 minutes ago, I saw an alarm on the Secondary ISE node stating that a Slow or Stuck Replication has been detected...
As I said in the original post, I can ping the fqdn's from each other so it appears that the DNS requirements have been satisfied.
I've changed the admin account password, I am certain that the ISE DB passwords are correct and the same on both nodes and the timezones for both nodes is the same also....
It looks to me that registration is fine, but the first full replication isn't completing successfully
Thanks,
JS

Similar Messages

ISE NODE NOT REACHABLE when building distributed deployment

I am trying to build a distributed deployment with the following personas:
2 policy admin nodes
2 monitoring nodes
4 policy service nodes
This was a project that was partially implemented but never in production. It was in a distributed deployment, but half the nodes were no longer working (http errors or devices weren't reachable or could not sync). I decided to start from scratch. All nodes were:
-de-registered
-application was reset to factory defaults on all nodes
-upgraded all 8 nodes to 1.1.4.218 patch 1
-installed all new certs and joined all nodes to the domain
-added to DNS forward and reverse lookup zones
When I make 1 admin node primary and register the other nodes (secondary admin, monitoring, policy services) the nodes successfully register and show up in the deployment window of the primary; however, all the nodes show as NODE NOT REACHABLE. After registration, I've noticed that the registered nodes are still showing as STANDALONE if I access the GUI. I've tried rebooting them manually after registration and they are still unreachable. I have also tried resetting the database user password from the CLI on both admin nodes and the results are always the same.

Originally I had added them all at the same time. I thought that maybe I just wasn't waiting long enough for the sync. I waited an entire day and all the nodes were still unreachable. At this point, I've de-registered all the nodes, rebooted all the nodes, converted the primary back to standalone (the remaining nodes never converted from standalone to distributed even when I rebooted them after registering despite a message that they were successfully registered), converted one node back to primary and tried to register just the secondary admin node giving it plenty of time to sync; this node is still not reachable from the primary.
I've quadruple checked the certificates on all the nodes, these certs were all added on the same day (just last week) and the default self-signed certs were removed.
I had restored from a backup on the primary so I might just rest the config on that node and try joining the other nodes before I restore again.

NODE-NOT-REACHABLE on ISE

Primary ISE node (Serving Admin and Monitor personas) is showing two of the PSNs as "NODE-NOT-REACHABLE" under Replication Status on Deployment page on GUI. It can ping the PSNs and PSNs are actually registered to the Primary admin/monitor node. How can I fix this?
Thanks,
Kashish

Hi,
I found the issue on ny network and it was due to a different dns record.
Simple way to check is issuing a dns lookup from admin node cli of the problem node. Then repeat from problem node attempting to resolve admin node.
Then if that looks good you can issue the command on both nodes...
Show logging application ise tail,
That output should give you a listing of the nodes in the ise deployment and the ip addresses of each node.
Thanks.
Sent from Cisco Technical Support Android App

Ise node is not reachable after upgrading 1.2

Hi, I was using beta version of ISE with 1.2.834 code. and now the official release came out so I upgraded it.
after that, the ISE is not communicating with AD, and when I go to download logs, It says node is not reachable even though it is STANDALONE mode.
does anyone know how to work around this ?
should I just delete everything and go from scratch ?

The ISE is not communicating to the AD, So, you have to rejoin the domain. For this purpose please follow the following actions:
Go to Administration > Identity Management > External Identity Stores and select Active Directory from the left-hand pane.
Click Join at the bottom of the configuration page:
Also please check the LDAP port

Clusterware Installation (Nodes not reachable....) 10G R2 on Windows

Hello Guys,
I am struck with this problem for quite a long time... I am installing Oracle Clusterware 10G R2 on windows 2000 operating system.
Well i have setup my public, private and virtual IP correctly, i can ping anyone of them.
During installation when it comes to the screen "Specify Cluster Configuration" i have entered the correct information of IPs on each node BUT when i click next button it says "
The following nodes do not appear to be reachable
rac1-vip
rac2-vip
Please check that nodes in the list are up and reachable
while i can ping rac1-vip.beaconhouse.edu.pk and rac2-vip.beaconhouse.edu.pk from both nodes and also the underlying IPs of these names.
Please help me to come out of this problem as i am struk with it.... cant continue installation while i have checked everything again and again...
Please Help...
Regards,
Imran Baig

This thread has already been answered at the DB General forum here: Re: During RAC Installation (Following Nodes do not appear to be reachable.
~ Madrid

Azure Website not reachable after successful publishing via VS

Hello,
I created a website (which locally runs without any problem) in VS 2013 pro and published it to Azure with Azure Tools. Everything looks good when publishing (the wizard says it can connect to the new web address and 'Web Publish Activity' tool window says
'Publish Succeeded'.)
However, when I try to browse the site on Azure ('https://www.yoursite.azurewebsites.net/') it doesn't work and I get ther error 'ERR_TUNNEL_CONNECTION_FAILED'.
Am I missing something? Do I have to do something in addition to just publishing the site from Visual Studio?
I'm quite unexperienced with Azure. Can someone tell me what the problem is or where I have to search for it?
Thanks in advance
Thomas

I have seen this happen a few times myself, It is the time between the deployment and the site start that is causing this issue, If you deploy from Visual studio, Visual Studio pops up a browser window for your site, sometimes for a large site that browser
starts before the site does, you can try a inprivate session and hit your site after VS deploys.
The issue happens as VS doesn't know the site has come up :(.
Let us know if you are not able to hit the site after the VS in any browser session, that is a serious problem that needs to be addressed.
-CB
Mark as Answer, Helps us help you better ! :). = CB

WAP4410N-E V02 not reachable after FW Upgrade

Hello Everyone,
I had some issues with our Accesspoints and decided to update the Firmware as it's discussed in several posts here in the forum.
Unfortunately this update from 2.0.4.2 to 2.0.6.1 was crashing the accesspoint eventually.
So here's what happened:
I downloaded the FW 2.0.6.1 from cisco.com and installed it via the webinterface as it's meant to be.
The installation was running and in the end showing me "Rebooting device". This took some time and then the page didn't reload and since then I've got no way to contact the Accespoint.
So I thought it may have been back to DHCP and had a look into the arp tables of the router, but nothing to see there with the mac address of the AP.
I also restartet it later by taking it from the power and plugging it back in. Still nothing!
Anyone here who had the same issue and was able to fix it?
Regards

Hi Chris,
I am Gyanendra Singh from Cisco SBSC. Thank you for bringing up this to our notice.
As mentioned you didn't receive the login page after firmware upgrade. It is possible that device was not upgraded. Try this setps to restore connectivity to your WAP4410N:
1-     Disconnect the device from LAN.
2-     Power cycle the device and wait till the device boots.
3-     Press and hold the Reset button for 30 seconds. This will factory reset the device.
4-     Connect it your LAN network wait for 10 seconds till the time it obtains TCP/IP settings from DHCP server. [You need to check on router for DHCP leased clients a.k.a DHCP binding database to know which IP address the device has taken]
5-     If you find any trouble in step 4, you can try connecting a workstation direclty with WAP4410N with a static IP address from the 192.168.1.0/24 pool. [Device has a default IP of 192.168.1.245/24, don't forget to restart the device after removing it from LAN for making sure it release the DHCP obtained IP]
6-     If all these steps are not helping you please reach to Cisco's Small Business Support Centre for further support.
Thanks and Regards,
Gyanendra Singh
Network Engineer | Cisco Small Business |

Photoshop Elements 12 Editor not working after Registration

After installing & registering my Adobe Photoshop Elements 12, a week or so has passed since I last played with it. The Organizer still works fine, but the Editor sends me to a registration screen, which ultimately ends up telling me to ensure the Internet is working (it is) or retry. Any idea what's up? I've tried restarting the computer, uninstalling/re-installing the software, and the ever popular, waited on the phone for 45 minutes until I got so tired of the music (no one ever picked up) that I just gave up. Thank You for Your Support!

Please share a screenshot of the erro message you are seeing when launching Editor?
Thanks
Andaleeb

Ise node not becoming standalone after deregistration

I am seeing a weird problem.
I deregistered secondary admin/monitor node from primary admin/monitor node. I see successfully deregistered message.
But the deregistered node is still showing SEC(A) and SEC(M). It is not changing to standalone mode.
This is disrupting the upgrade of distributed deployment of ISE nodes.
Any clues?

Bug details:
Secondary node never becomes standalone after de-registration
The secondary node is de-registered successfully but a "The following deregistered nodes are not currently reachable: . Be sure to reset the configuration on these nodes manually, as they may not revert to Standalone on their own." message appears to the administrator.
Workaround Log in to the administrator user interface with internal Cisco ISE administrator credentials when de-registering a node.
Actually we had two accounts in web gui, nodes were registered using one account and during upgrade, i used different account , which triggered this bug.

Cisco ISE deregister node not available

Hello,
I installed two ISE node and registered the second node. Yesterday I saw an error message: Sync failed, deregister and register the second node.
I deregistered the second node and tried register again, but not worked. Now, the second node is showing in the first node but I can not deregister or register again, how I can deregister the second node to register again?

This seems to be an issue with invalid certificates. Have you already checked the certificates on both the sides. Also restart the services of secondary nodes one and check again.
As a next step, we need to look inside ise-psc.logs to further troubleshoot this issue.
Regards,
Jatin Katyal
**Do rate helpful posts**

Unable to register secondary node on Cisco ISE 1.1.4

Hello,
I have a problems with registering the secondary node on Cisco ISE 1.1.4.
I did all like described on User Guide:
- Primary ISE is promoted to PRIMARY.
- DNS entries are added and resolved for both ISEs
- The "Certificate Store" on both ISEs are populated with self-signed certificates from both ISEs.
Durring the registration process (from Primary node), when I add the IP, username and password for secondary node, an empty popup message displayed with only button "OK".
So, I cannot proceed to far and don't see the error indicated what's wrong.
In attachment - screenshot with popup message.
I use IE 8.0.6001.
The lattest patch (1.1.4.218-7-87377) applied on both ISEs.
Is somebody had the similar problem?
Thanks,
PC

Hello,
In the debug logs "ise-psc.log" I see :
2013-11-11 08:43:47,534 ERROR 2013-11-11 08:43:47,534 [http-443-7][] cpm.admin.infra.action.DeploymentEditAction- An exception occurred during the registration of a deployment node: java.lang.NullPointerException
java.lang.NullPointerException
at com.cisco.cpm.admin.infra.action.DeploymentEditAction.registerSubmit(DeploymentEditAction.java:455)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.cisco.webui.action.common.PojoActionProxy.performExecution(PojoActionProxy.java:176)
at com.cisco.webui.action.common.PojoActionProxy.execute(PojoActionProxy.java:89)
at org.apache.struts.chain.commands.servlet.ExecuteAction.execute(ExecuteAction.java:58)
at org.apache.struts.chain.commands.AbstractExecuteAction.execute(AbstractExecuteAction.java:67)
at org.apache.struts.chain.commands.ActionCommandBase.execute(ActionCommandBase.java:51)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:191)
at org.apache.commons.chain.generic.LookupCommand.execute(LookupCommand.java:305)
at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:191)
at org.apache.struts.chain.ComposableRequestProcessor.process(ComposableRequestProcessor.java:283)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1913)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:462)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.xmp.wap.dojo.servlet.filter.DojoIframeSendFilter.doFilter(DojoIframeSendFilter.java:58)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.admin.infra.utils.WebCleanCacheFilter.doFilter(WebCleanCacheFilter.java:35)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.rbacfilter.AccessCheckFilter.doFilter(AccessCheckFilter.java:71)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.admin.infra.utils.UserInfoFilter.doFilter(UserInfoFilter.java:110)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.admin.infra.utils.CsrfPreventionFilter.doFilter(CsrfPreventionFilter.java:113)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.admin.infra.utils.LoginCheckFilter.doFilter(LoginCheckFilter.java:188)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at com.cisco.cpm.admin.infra.utils.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:121)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:563)
at org.apache.catalina.valves.RequestFilterValve.process(RequestFilterValve.java:316)
at org.apache.catalina.valves.LocalAddrValve.invoke(LocalAddrValve.java:43)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:394)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.valves.MethodsValve.invoke(MethodsValve.java:52)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Unknown Source)
2013-11-11 08:44:00,226 INFO 2013-11-11 08:44:00,226 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- editPreload() triggered. Selected hostname is BB1NACEASTP01
2013-11-11 08:44:00,226 INFO 2013-11-11 08:44:00,226 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- ParameterNames in load()= BB1NACEASTP01
2013-11-11 08:44:00,226 INFO 2013-11-11 08:44:00,226 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- editPreload(): userName= adminhostname= BB1NACEASTP01
2013-11-11 08:44:01,017 INFO 2013-11-11 08:44:01,017 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- ParameterNames in load()= BB1NACEASTP01
2013-11-11 08:44:01,017 INFO 2013-11-11 08:44:01,017 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- Inside load() API : hostNameBB1NACEASTP01 userName : admin
2013-11-11 08:44:01,017 INFO 2013-11-11 08:44:01,017 [http-443-1][] cpm.admin.infra.action.SupportBundleAction- Inside fetchFile() API : hostName: BB1NACEASTP01 userName : admin
2013-11-11 08:44:01,018 INFO 2013-11-11 08:44:01,018 [http-443-3][] cpm.admin.infra.action.SupportBundleAction- ParameterNames in sbfCreationPercentage()= BB1NACEASTP01
2013-11-11 08:44:01,021 INFO 2013-11-11 08:44:01,021 [http-443-3][] cpm.admin.infra.action.SupportBundleAction- Got hostAlias= BB1NACEASTP01
2013-11-11 08:44:01,021 INFO 2013-11-11 08:44:01,021 [http-443-3][] cpm.admin.infra.action.SupportBundleAction- Ping node: BB1NACEASTP01 for connectivity
2013-11-11 08:44:01,181 INFO 2013-11-11 08:44:01,181 [http-443-3][] cpm.admin.infra.action.SupportBundleAction- Received pingNode response : Node is reachable

SAP Failover not working on secondary node

Hi All
We have configured HA of SAP on DB2: ASCS,CI and SCS is running on primary node with HACMP clustering installed with virtual hostname,and just running DB2 client on secondary node.
Now we are receiving following error while switching over manually on the secondary node:
Starting SAP-Collector Daemon
21:34:58 26.07.2010   LOG: Effective User Id is root
This is Saposcol Version COLL 20.94 700 - AIX v10.35 5L-64 bit 070123
Usage: saposcol -l: Start OS Collector
        saposcol -k: Stop OS Collector
        saposcol -d: OS Collector Dialog Mode
        saposcol -s: OS Collector Status
The OS Collector (PID 233504) is already running .....
saposcol already running
Running /usr/sap/BP1/SYS/exe/run/startdb
DB startup failed
Below is the output of R3trans -d
This is R3trans version 6.14 (release 700 - 15.06.07 - 15:50:00).
unicode enabled version
2EETW169 no connect possible: "environment variable dbms_type is not set."
R3trans finished (0012).
And the output of tran.log is as follows:
4 ETW000 R3trans version 6.14 (release 700 - 15.06.07 - 15:50:00).
4 ETW000 unicode enabled version
4 ETW000 ===============================================
4 ETW000
4 ETW000 date&time   : 26.07.2010 - 21:35:52
4 ETW000 control file: <no ctrlfile>
4 ETW000 R3trans was called as follows: R3trans -d
4 ETW000 trace at level 2 opened for a given file pointer
4 ETW000 [dev trc     ,00000] Mon Jul 26 21:35:52 2010
      51 0.000051
4 ETW000 [dev trc     ,00000] db_con_init called
      20 0.000071
4 ETW000 [dev trc     ,00000] create_con (con_name=R/3)
      33 0.000104
*4 ETW000 [dbcon.c     ,00000] *** ERROR => Invalid profile parameter dbms/type*
(or environment variable dbms_type) = <undef>, cannot load DB library
4 ETW000
      52 0.000156
2EETW169 no connect possible: "environment variable dbms_type is not set."
Kindly let us know how to go about in resolving this issue.
Thanks in Advance
Hemant

> Now we are receiving following error while switching over manually on the secondary node:
> 2EETW169 no connect possible: "environment variable dbms_type is not set."
The user <sid>adm lacks the proper environment. Is this environment variable set on both nodes?
Markus

Connect some users on ISE Secondary node

Is it possible to connect users on secondary node?
I tried it. I configure one switch to connect on the secondary node. A computer on that switch communicate with the secondary node and get and IP address from the DHCP. but It cannot download DACL.

Yes you can point the users to the secondary server and have them authenticate, within ise the primary and secondary status only applies to admin and the monitoring personas, as as the node is running the policy services they are all considered their own standalone radius server.
please use the "debug radius authentication" and all check the replicstion status and see if it is in sync and completed.
Thanks
Tarik Admani
*Please rate helpful posts*

One instance not failling over to secondary node

Hi, i have a instance which i just install which is not failling over to the 2nd node.I come across this screen below and notice that the 2nd instance is only attached to one node. How do I add the secondary node to the instance ?

How did you install this new instance? Did you not install using the option "New SQL Server
failover cluster installation"?
Satish Kartan www.sqlfood.com

I can not configure the secondary node for shared appl_top

when i run the perl -l txkSOHM.pl comand in the secondary node for shared appl_top. the system returns a "valid java executable not found"
i did check all my environments variables, all is exactly just like the primary node.
anybody can help me???

$ perl -l txkSOHM.pl
Absolute path of Application's Context XML file :
/u01/oracle/snb2appl/admin/SNB2_pth1ap.xml
Type of Instance [primary/secondary] :
secondary
Absolute path of 8.0.6 Shared Oracle Home :
/u03/oracle/snb2ora/8.0.6
Absolute path of iAS Shared Oracle Home :
/u03/oracle/snb2ora/iAS
Absolute path of config top :
/u03/oracle/PTH1
Oracle Application apps schema password :
pu3rt0
*** USER FEEDBACK ***
Absolute path of Application's Context XML file : /u01/oracle/snb2appl/admin/SNB2_pth1ap.xml
Type of Instance [primary/secondary] : secondary
Absolute path of Shared Oracle Home top :
Absolute path of 8.0.6 Shared Oracle Home : /u03/oracle/snb2ora/8.0.6
Absolute path of iAS Shared Oracle Home : /u03/oracle/snb2ora/iAS
Absolute path of config top : /u03/oracle/PTH1
Run AutoConfig [y/n] : y
Oracle Application apps schema password : pu3rt0
Absolute path of the log file : /u02/oracle/pth1comn/admin/log/SNB2_pth1ap/txkSetSOHM.log
Prompt for confirmation [y/n] : n
Absolute path of 8.0.6 config Home : /u03/oracle/PTH1/8.0.6
Absolute path of iAS config Home : /u03/oracle/PTH1/iAS
Application's Context file Saved as : /u01/oracle/snb2appl/admin/SNB2_pth1ap.xml.SOH
Valid java executable not found

ISE 1.1.3.124 secondary node not reachable after registration

Similar Messages

Maybe you are looking for