ISE 1.2 - Bugs (upgrade)

1) impossible to set a scheduled backup: calendar window shows "0" insted of the year or randomly "1900"... (forward button works, back button not) clicking "save" is useless as it doesn't respond (FF, Chrome, IE10)
2) Cliking on the nad interface from monitoring (real time authentications) leads to
"SNMP information is not configured for this device in ISE" on the old version only community "public" worked, now nor public nor others..
3) CLI is strangely behaving as lots of blank lines are pushed to terminal in between the last login information and the "ISELAB3315/admin#" (maybe this is a teraterm fault but never happened before)
this the result of 2h testing... quite a shame

Thank you Marcin
@guardian-de :
same for me (upgrading from 1.1.4 to 1.2)
as for point 2 this is the debug snmp request on the switch:
Jul 31 08:43:30.312: SNMP: Packet received via UDP from 172.31.85.13 on Vlan32Jul 31 08:43:30.320: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:30.320: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:30.329: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:30.329: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:30.572: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:30.824: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:35.320: SNMP: Packet received via UDP from 172.31.85.13 on Vlan32Jul 31 08:43:35.345: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:35.345: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:35.362: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:35.362: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:35.597: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:35.874: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:40.320: SNMP: Packet received via UDP from 172.31.85.13 on Vlan32Jul 31 08:43:40.328: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:40.328: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:40.345: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:40.345: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:40.580: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:40.832: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:45.320: SNMP: Packet received via UDP from 172.31.85.13 on Vlan32Jul 31 08:43:45.328: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:45.328: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:45.345: SNMP: Queuing packet to 172.31.85.13Jul 31 08:43:45.345: SNMP: V1 Trap, ent snmpTraps, addr 172.20.32.12, gentrap 4, spectrap 0 lsystem.5.0 = 172.31.85.13 ciscoMgmt.412.1.1.1.0 = 1 ciscoMgmt.412.1.1.2.0 = 172.31.85.13Jul 31 08:43:45.580: SNMP: Packet sent via UDP to 172.31.85.13Jul 31 08:43:45.831: SNMP: Packet sent via UDP to 172.31.85.13

Similar Messages

How do I create a Repository in ISE for 1.2 upgrade?

Hello,
I am upgrading out 1.1.4 ISE nodes to version 1.2 in the next few weeks. Following the Cisco guide for this I should create repositories on both our admin nodes and store the upgrade file locally. These repositories cannot be created using the UI. They must be created using the CLI.
How do I create and name the repositories so that I can ftp the upgrade file to this location?
Thank you.

Correct...Having the upgrade bundle in the local repository significantly reduces the time it takes to download it from the network during the upgrade process.
You may want to go through the below listed links
Important Notes To Read Before You Upgrade to Release 1.2
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html#ID50
https://supportforums.cisco.com/community/netpro/security/aaa/blog/2013/07/19/upgrading-to-identity-services-engine-ise-12
~BR
Jatin Katyal
**Do rate helpful posts**

[BUG] Upgrade corrupts photo book layouts!

Here's something to add to the plethora of bugs in iLife'11. Whenever I open a photo book that was created with an earlier version, I briefly see the "Upgrading photo book…" message, and after that, all photos are default-zoom and centered at their spots in the book layout!
I have >20 books in my library and a lot of effort went into making their layout just perfect. The problem does not yet appear in iPhoto 8.1.2, I have been experimenting with several "upgrade paths" from iPhoto 7.1.5 to iPhoto 9.0.1 now. It is clearly a problem in iPhoto 9.
When going directly from iPhoto 7 to 9, by the way, you lose all the key photo selections that you have done in your events (>200 for me…), as already reported here:
http://discussions.apple.com/thread.jspa?messageID=12495859&#12495859
So if any of you are also keeping their photos in nicely layouted photo books, I strongly recommend waiting with the upgrade to iLife'11 until Apple fixes the upgrade process to NOT destroy any data.

Same problem here with all photo books!
iPhoto '11 does in fact display a warning after the update, something like "update successful, but please check before ordering". Well, I checked, and I found all books are corrupted (zoom and offset are wrong as described above).
This dialog however is a pathetic way of dealing with the (apparently known!) problem, Apple!
Even worse, I noticed that TimeMachine backup (inside iPhoto) does not list photo books, so the only way back (after wiping iPhoto 11 from the hard drive and re-installing the previous version) seems to be to replace the whole iPhoto Library manually (I sincerely hope that the photo books are stored in there and not anywhere else - does anyone know for sure?)
There also is no way to export a photo book (apart from non-editable PDF) and to re-import it on another MacOS installation (with an earlier version of iPhoto), is there? So until I find a solution and the time to try it out, I need to keep my pre-update backup of the whole iPhoto Library. And I must not make any significant changes to the new library, because there very probably is no way of merging those changes into the old one.
G.

ISE nac Agent automatic upgrade possible ?

Hello all,
I have this :
802.1x windows with NacAgent version (let's say 1) <----> 802.1x Enabled Switch (aaa radius OK) <------> ISE and AD on the same LAN
ISE is configured for client provisionning with material (NacAgent version 2) downloaded from Cisco website (as depicted in the documentation)
I've a basic authentication and authorization scheme that let me in properly but I expect the NACAgent to be upgraded.
No profiling is configured for the time being.
Is anybody can help ?
Best regards ?

Hi Tarik,
Your are right regarding that option "upgrade is mandatory"
However, my case was that you do need to enter the ISE's FQDN on the NAC Client and make sure that DNS operates properly.
Once authenticated, the NAC agent shows an upgrade message.
It works.
Thank you all.

Minor bug upgrading from apex 3.1 to 4.1

I have an application written by someone else in apex 3.1. When upgrading to apex 4.1 some pages failed to work. This was because for some reason there was a condition on a process which had a begin and end when the condition was of type: "NOT EXISTS (SQL qurey returns no rows".
This was combines by the process being:
begin
null;
end;
Anyway I thought I might share obviously this was crap code but maybe the upgrade process should run better then that.

Hi Ben,
are you upgrading your existing machine or are you setting up a new environment with Oracle 11g and APEX 4.2? If that's the case you can use have a look at http://www.talkapex.com/2012/04/command-line-backups-for-apex.html which creates export scripts for all your workspaces and applications. Those export scripts can than easily be imported with SQL*Plus. Note: Please have a look at bug# 14777994 in our Known Issues list at http://www.oracle.com/technetwork/developer-tools/apex/application-express/apex-42-known-issues-1863578.html
If you are upgrading your existing database, you don't have to export/import. When you upgrade APEX to 4.2 all your existing workspaces and applications will be upgraded to 4.2 as well.
Regards
Patrick
My Blog: http://www.inside-oracle-apex.com
APEX Plug-Ins: http://apex.oracle.com/plugins
Twitter: http://www.twitter.com/patrickwolf

Does Anybody know how to keep the license files and Certificates in ISE-3315 During the upgrade.

Hi,
I have two ISE-3315 Appliances in production network.
I need someone's help to explain, how to make the Secondary node as the primary admin note to reset-config.
And then I would like to know how to keep the license files and Certificate during the Upgrade.
Please help me to answer my questions.
Thanks
CSCO11872447

The Cisco Identity Services Engine (ISE) provides distributed deployment of runtime services with centralized configuration and management. Multiple nodes can be deployed together in a distributed fashion to support failover.
If you register a secondary Monitoring ISE node, it is recommended that you first back up the primary Monitoring ISE node and then restore the data to the new secondary Monitoring ISE node. This ensures that the history of the primary Monitoring ISE node is in sync with the new secondary node as new changes are replicated.
Please Check the below configuration guide for Secondary ISE- Nodes.
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.pdf

ISE 1.3 bugs in Guest Types?

Hi,
I've created a guest type that looks like this:
Maximum account duration: 90 days
Allow 15 simultaneous logins
Removes the oldes connection
Maximum device guest can register: 1
When I log in to the sponsor portal and select the created guest type, the text doesnt reflect the settings above.
"Maximum devices that can be connected: 1
Maximum access duration: 90 days "
The first line should not say "1", it should be "15". Is this a bug?
In addition to this, the default value of 90 days is not presented in the textbox in the sponsorportal. Instead I get the value of 83.
If I try to write 90 and tab to the next field, it goes back to 83. If I manualy change the date, it sticks to 90. Bug?
BR
Robert

Could be bug CSCul15779

After ISE 1.2 upgrade I get "5413 RADIUS Accounting-Request dropped."

Hello,
I have a two admin node setup for ISE. I just upgraded one of my two ISE Admin nodes to Version 1.2. I still have one of my admin nodes at 1.1.4. When I disable my Version 1.1.4 node and allow wireless authentications to be handled by the Version 1.2 node I get the message..."5413 RADIUS Accounting-Request dropped". None of my wireless edge devices will be allowed on the network during this time. When I re-enable my 1.1.4 node my wireless devices are then allowed on the network.
I am currently using ISE to authenticate wireless connectivity.
I also get the failure reason... "11038 RADIUS Accounting-Request header contains invalid Authentication field".
Any ideas?
Bob

The 5413 RADIUS Accounting-Request dropped may be because the session was active on ISE1 and is now sending update messages to ISE2. Also, verify your shared secret radius key matches on both the wlc and ISE servers. I would try clearing the WLC connection for the test user when switching. Just turning off wireless and back on doesn't do it. Also, are you using PEAP-MSChapv2 or EAP-TLS for authenticating the clients. What type of certificate is presented, public or private?

How to upgrade newly purchased ISE 1.2 ( hardware appliance ) to ISE 1.3

Hi Experts,
We have purchased ISE 1.2 ( hardware appliance ) however we would need Anyconnect 4.0 agent software which needs minimum ISE 1.3 version.
Can anybody please guide me how do i upgrade this newly purchased device directly to ISE 1.3 ? we have not even switched on the hardware.
how about licenses which we have bought ? can we directly install on ISE 1.3 after upgrade ?

hello Vinod, what are the license you have bought. With ISE 1.2.1 we have new licensing scheme (plus license) and with 1.3 we have Apex, mobility license as well.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_license.html#41012
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html

ISE upgrade failing with "% Manifest file not found in the bundle"

Hello
I am trying to upgrade a brand new ISE 3395 from 1.0.3.337 to 1.0.4 (latest). It keeps failing with
% Manifest file not found in the bundle
Here is the output:
company-ise-01/admin# application upgrade ise-appbundle-1.0.4.573.i386.tar.gpg ftp
Save the current ADE-OS running configuration? (yes/no) [yes] ?
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Upgrade...
% Manifest file not found in the bundle
fusd-ise-01/admin# sh application version ise
Cisco Identity Services Engine
Version      : 1.0.3.377
Build Date   : Fri May 6 19:30:37 2011
Install Date : Wed Oct 12 22:18:26 2011
I can't find anything about this for ISE, although there are a lot of topics for the same error for ACS. Thanks in advance.
Saro

Same problem with 1.1.2 and 1.1.1 patch 5:
ISEcdemo/admin# sh ver
Cisco Application Deployment Engine OS Release: 2.0
ADE-OS Build Version: 2.0.4.018
ADE-OS System Architecture: i386
Copyright (c) 2005-2011 by Cisco Systems, Inc.
All rights reserved.
Hostname: ISEcdemo
Version information of installed applications
Cisco Identity Services Engine
Version      : 1.1.1.268
Build Date   : Mon Jun 25 05:49:23 2012
Install Date : Wed Sep 12 09:12:53 2012
Cisco Identity Services Engine Patch
Version      : 1
Install Date : Wed Sep 12 10:01:22 2012
Cisco Identity Services Engine Patch
Version      : 2
Install Date : Wed Sep 12 13:10:36 2012
Cisco Identity Services Engine Patch
Version      : 3
Install Date : Tue Nov 27 12:33:19 2012
Cisco Identity Services Engine Patch
Version      : 4
Install Date : Tue Nov 27 12:52:50 2012
ISEcdemo/admin# patch install ise-patchbundle-1.1.1.268-5-68046.i386.tar.gz my2
Save the current ADE-OS running configuration? (yes/no) [yes] ? yes
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Patch installation...
% Manifest file not found in the bundle
ISEcdemo/admin#
ISEcdemo/admin# application upgrade ise-appbundle-1.1.2.145.i386.tar.gz my2
Save the current ADE-OS running configuration? (yes/no) [yes] ? yes
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Upgrade...
% Manifest file not found in the bundle
Can someone verify the downloaded file details? They are different from cisco.com values:
-bash-4.1$ /usr/bin/md5sum.exe /cygdrive/c/munka-unenc/tftp/ise-appbundle-1.1.2.145.i386.tar.gz
2aa9b75ef5d7c1662a1a51844f178b77 */cygdrive/c/munka-unenc/tftp/ise-appbundle-1.1.2.145.i386.tar.gz
-bash-4.1$ /usr/bin/ls -lAp /cygdrive/c/munka-unenc/tftp/ise-appbundle-1.1.2.145.i386.tar.gz
-rwx------+ 1 Administrators Domain Users 1583851520 Nov 29 00:14 /cygdrive/c/munka-unenc/tftp/ise-appbundle-1.1.2.145.i386.tar.gz

Disk size in ise

Hi
I have a strange problem after instaling licenses in ISE the following information is in a "show tech"
This info is for 1.3 clean install + license.
% WARNING: ISE DISK SIZE NOT LARGE ENOUGH FOR PRODUCTION USE
% RECOMMENDED DISK SIZE: 200 GB, CURRENT DISK SIZE: 0 GB
It is the same in the Eval version but in this server there is a 2500 license
The same is observed in both ISE 1.2.1 and 1.3 (running a POC on ISE)
When trying to upgrade ISE 1.2.1 > 1.3 the following output
Getting bundle to local machine...
md5: ad7d87d383661bce671804a9e125e42b
sha256: 2a7ebe5196e3d956ac42ec2e5acdf3815a3e0f80db954b58e2c68843bb3c42fd
% Please confirm above crypto hash matches what is posted on Cisco download site.
% Continue? Y/N [Y] ? Y
Unbundling Application Package...
Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
-Checking VM for minimum hardware requirements
% Error: At least 100GB sized hard disk required for upgrade.
the disk is
Hard Disk Count(*): 1
Disk 0: Device Name: /dev/sda
Disk 0: Capacity: 644.20 GB
Disk 0: Geometry: 255 heads 63 sectors/track 78325 cylinders
Thanks
Erik Loeth

Attached is the output from VMware, this is made with the OVA
ISE-1.3.0.876-virtual-SNS3495-2.ova
The disk output from show inventory
NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis"
PID: ISE-VM-K9 , VID: V01 , SN: XXXXXXXXXXXXXXX
Total RAM Memory: 16467264 kB
CPU Core Count: 4
CPU 0: Model Info: Intel(R) Xeon(R) CPU E7- 4870 @ 2.40GHz
CPU 1: Model Info: Intel(R) Xeon(R) CPU E7- 4870 @ 2.40GHz
CPU 2: Model Info: Intel(R) Xeon(R) CPU E7- 4870 @ 2.40GHz
CPU 3: Model Info: Intel(R) Xeon(R) CPU E7- 4870 @ 2.40GHz
Hard Disk Count(*): 1
Disk 0: Device Name: /dev/sda
Disk 0: Capacity: 644.20 GB
Disk 0: Geometry: 255 heads 63 sectors/track 78325 cylinders
NIC Count: 1
NIC 0: Device Name: eth0
NIC 0: HW Address: XXXXXXXXXXXXXXXXXX
NIC 0: Driver Descr: Intel(R) PRO/1000 Network Driver
(*) Hard Disk Count may be Logical.
Reards
Erik Loeth

ISE: Changing Policy Mode

Hi
I want to move to policy sets from our current compex set of rules, has anyone done this and if so what happens to your existing rules?
I've looked through the documentation and all it says is that you can change the policy mode but not what happens to your existing policy.
Thanks

Hi Martin,
After you do a fresh install of ISE 1.2 or upgrade from Cisco ISE, Release 1.1 to ISE version 1.2, the Simple Mode policy model is selected by default.
If you choose to switch to Policy Set Mode from Simple Mode, the authentication and authorization policies are migrated to the default policy set.
If you choose to switch to Simple Mode from Policy Set Mode, the authentication and authorization of the default policy set are migrated to be the authentication and authorization policies. All other policy set policies are deleted.
For more information on evaluation of policy set please refer to ISE 1.2 User Guide.
Here is the link for the same.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_auth_pol.html#pgfId-1324786

ISE - Discovery Host

Dear All,
I am facing issue with automatic discovery of ISE node by NAC agent (Discovery Host). Our client was using Cisco NAC 3310 appliances which has been replaced by ISE and we have upgraded the NAC agent software as well. Now what is happening that whenever NAC agent starts on a user PC it shows ip address of old NAC manager in the discovery host field of NAC agent and due to this, posture assesment doesn't complete and user gets stuck in remediation state.
As a work arround , I changed the ip address manually in Discovery Host option of NAC agent to point towards new ISE node and then posture assesment gets completed. So kindly advice how I can make this process automatic so that NAC agent should communicated with ISE automatically.
Regards,
Mujeeb

Hi,
It has been resolved without manual entry in NAC agent or NACAgentCFG file. Actually the redirection was not working properly for agent so I changed the redirect ACL as follows,
ip access-list ext ACL-AGENT-REDIRECT
#deny udp any any eq 53
#permit tcp any any eq 80
Kindly refer following document for the same.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_10_universal_switch_config.pdf
Now the agent is able to find the primary ISE node and posture is woking fine.
Regards,
Mujeeb

Upgrading of WLS 6.1 from SP3 to SP5

Can anyone help me.
I am going to upgrade WLS 6.1 from SP3 to SP5.
How can i do this ?
From where do i download the ServicePack (SP5) ?
Is there someting i have to be aware off, about the license ?

Hi Paul
This is a JVM bug, Upgrade to 1.3.1_08 jvm from sun
Contact weblogic support for temporary workaround
Paul Wilson wrote:
We've a client running 6.1 sp2 on Solaris, who is experiencing
Weblogic hanging for roughly 10 minutes at a time. On resumption they
get:
####<06-May-03 16:28:50 BST> <Critical> <WebLogicServer> <edox>
<Mendel> <ListenThread> <system> <> <000204> <Failed to listen on port
80, failure count: 1, failing for 1,052,234,928 seconds,
java.net.SocketException: Software caused connection abort>
####<06-May-03 16:28:51 BST> <Notice> <WebLogicServer> <edox> <Mendel>
<ListenThread> <system> <> <000205> <After having failed to listen,
the server is now listening on port 80>
The last time it occurred, I got them to take a thread dump and all
but one execution thread and the listener threads were idle. One
execution thread was busy reloading (or loading) a class from the war.
I've asked them to ensure that the reload period is -1, but that
shouldn't cause a 10 minute hang; plus nothing had changed. Red
herring?
As an experiment I wrote a servlet that just blocks its execution
thread: after about a thousand calls to this on our dev box, we get
<May 14, 2003 5:45:42 PM BST> <Critical> <WebLogicServer> <Failed to
listen on port 6001, failure count: 3, failing for 1,052,930,739
seconds, java.net.SocketException: Too many open files>
AFAIK this means that we've run out of file descriptors. Our client
doesn't get this, so I don't think that is happening to them.
A number of people on weblogic.* groups reported similar problems
about a year ago, but without any really definitive resolutions.
Anyone solved this, even by upgrading?

Cisco ise Repository not found

I have a standalone ISE node, which is being stubborn about an upgrade...
The docs say this should work, but I'm getting an error...
ISE-01/admin# application upgrade ise-upgradebundle-1.1.x-to-1.2.0.899.i386.tar.gz disk
Save the current ADE-OS running configuration? (yes/no) [yes] ? yes
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Upgrade...
% Repository not found
ISE-01/admin#

Important Notes To Read Before You Upgrade
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/upgrade_guide/b_ise_upgrade_guide/b_ise_upgrade_guide_chapter_01.html#ID50

ISE 1.2 - Bugs (upgrade)

Similar Messages

Maybe you are looking for