ISE Admin node Replication error

Hello Everyone,
I receive this alarm some times:
Alarm
Occurred At:
Wed Mar 20 09:20:10 BRT 2013
Cause:
Replication Stopped
Details:
Replication Stopped for the host PANVMGP3301B(Secundary Admin node)
Today i go to Administration -> System -> Deplyment and i can see my secundary Admin/Monitoring node with status "REPLICATION DISABLED" see the attach image.
I can force the sync for the Primary and Secundary Admin Nodes? How i can fix this?
Tks!

Yes, something prevented your nodes from staying in sync and as a result, the nodes stopped trying to syncup. You will need to manually sync the nodes. Go to Administration > Deployment. Then select/check all of the nodes and click on the "Syncup" button above the personas.
Thank you for rating!

Similar Messages

ISE admin , PSN and monitoring node fail-over and fall back scenario

Hi Experts,
I have question about ISE failover .
I have two ISE appliaces in two different location . I am trying to understand the fail-over scenario and fall-back scenario
I have gone through document as well however still not clear.
my Primary ISE server would have primary admin role , primary monitoring node and secondary ISE would have secondary admin and secondary monitoring role .
In case of primary ISE appliance failure , I will have to login into secondary ISE node and make admin role as primary but how about if primary ISE comes back ? what would be scenario ?
during the primary failure will there any impact with users for authentication ? as far as PSN is available from secondary , it should work ...right ?
and what is the actual method to promote the secondary ISE admin node to primary ? do i have to even manually make monitoring node role changes ?
will i have to reboot the secondary ISE after promoting admin role to primary ?

We have the same set up across an OTV link and have tested this scenario out multiple times. You don't have to do anything if communication is broken between the prim and secondary nodes. The secondary will automatically start authenticating devices that it is in contact with. If you promote the secondary to primary after the link is broke it will assume the primary role when the link is restored and force the former primary nodes to secondary.

Adding license to an ISE secondary admin node

We have an ISE cluster with the license installed only on the primary admin node (generated on its UDI).
If we later have to promote the secondary admin node to be the new primary admin node (for some reson), then we need to have a valid license on that node generated with its UDI, right?
Is it possible to install the secondary admin UDI license from the primary admin node or do we have to deregister the secondary admin node from the cluster and then install the license on that node in standalone mode ?

You could also re-host the license to the new (promoted) node. The steps are detailed here:
https://supportforums.cisco.com/discussion/12378756/cisco-ise-migration-vm-sns-3415-appliance
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE PSN node won't join cluster

Hi All,
Has anyone seen an issue where a PSN can't join the cluster ?
We join PSN Node
-Node is registered sucessfully (sync in progress)
- 1hr later - Replication to node failed.
- Replication Sync failed due to Secondary Database is down
I have a customer where admin node and PSN are seperated by firewall.
We allow in both directions
Admin <--> PSN
ICMP
HTTPS
1521
Firewall not showing drops.
DNS and NTP are ok.
Current topology is 1 PSN, 1 Admin node.
Works fine in our test lab, but not customers environmnet.
Cheers
Peter.

You will probably need more stuff opened between the PSN and the network but your rules between Admin and PSN. You might wanna add syslog udp 20514 as well.
Also, what type of FW are you using? If ASA what happens if you run packet tracer and/or packet capture? Is the flow allowed through and do you see the packets in the capture
Last but not the least, can you confirm that the DB service is running on the secondary node? From CLI run "show application status ise" If is not either restart the node or just issue "application start ise"
Thank you for rating!

ISE Inline Node

I have an ISE Inline Node that I successfully added to my admin ISE node. After I added the inline node, I wasn't able to configure it until later. When I went back to edit the configuration, the admin node says it is not able to communicate with the inline node. Below is the exact error:
Could not establish secure connection with Inline Posture node. Please be sure that certificates are configured correctly for mutual authentication between this node and the Inline Posture node.
The certificates haven't changed since I initially added the node. Also I am not able to open an SSL session to the trusted IP of the inline node. I am not sure if this is normal or not.

Yes I caught this during the upgrade, so my nodes were already deregistered. Since I was planning on rebuilding my setup I went ahead and reset the configuration (or you can issue the pep switchoutof-pep command - http://www.cisco.com/en/US/docs/security/ise/1.1/cli_ref_guide/ise_cli_app_a.html#wp2150747) in order to rollback the configuration to standalone and make the certificate change.
Just for you reference here is the link that will help you nail down the cert requirements (Step 3) -
http://www.cisco.com/en/US/docs/security/ise/1.1.1/release_notes/ise111_rn.html#wp248769
This should do the trick for you!
Tarik Admani
*Please rate helpful posts*

Cisco ISE Monitoring node backup size

Hello All,
We have a HA pair of ISE servers that have scheduled backups configured for the Admin persona (currently full weekly backup) and monitoring which is full weekly but with the addtional incremental daily backups. I've not seen any issue with the full weekly backup of the admin node however the monitor one provides unusual results in terms of file size between weekly and incremental backups.
Given the fact that we are currently piloting this with very little radius activity i'm curious as to how the daily backups can be bigger in filesize than the weekly?
The ISE is a ISE-3315-K9 running 1.1.3.124 and below are some examples
-rw-r--r-- 1 tsmbackup tsmbackup 502960384 Apr 21 07:08 mntincr_1_<removed>.tar.gpg (Incremental backup)
-rw-r--r-- 1 tsmbackup tsmbackup 459348307 Apr 21 01:04 mntdbfull_<removed>.tar.gpg (Full backup)
Thanks in advance for any suggestions.
M

Hi,
This could possibly due to ‘Data Purging’. When a purge operation triggers, if the actual used database disk space is greater than the configured threshold, the purge operation removes all data from the Monitoring database tables prior to the data retention window.
Following link might help in your case,
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1074687

Cisco ISE 1.1.4 Error Code 500

Hello,
I just installed the evaluation of Cisco ISE 1.1.4 on ESXi 5.1.
My EXSi config is this:
4GB RAM, 80GB HDD, 2 cores, Redhat 5 32bit
I was able to install it with no problem, but when I tried to login using the web GUI, I am getting an error message stating:
Internal Error
Error Code 500.
I am able to login using the console and SSH. I already set the correct timezone for both ISE and my computer. I also tried different browsers, but I am still getting the same error and can't login at all via GUI.
Any help would be greatly appreciated.
Thanks

Here is my show application status ise output
KA-ISE/admin# show application status ise
ISE Database listener is running, PID: 3960
ISE Database is running, number of processes: 28
ISE Application Server is still initializing.
ISE M&T Session Database is running, PID: 3620
ISE M&T Log Collector is running, PID: 5785
ISE M&T Log Processor is running, PID: 6001
ISE M&T Alert Process is running, PID: 5674
% WARNING: ISE DISK SIZE NOT LARGE ENOUGH FOR PRODUCTION USE
% RECOMMENDED DISK SIZE: 200 GB, CURRENT DISK SIZE: 85 GB
KA-ISE/admin#
I have rebooted my ISE server, but I am still getting the same error message. Regarding the DNS, I have not set up my AD/DNS yet. But I am guessing I should be able to GUI to ISE server regardless of not having it connected to AD or DNS.

Cisco ISE Admin and EAP certificate renewal

Hi board,
maybe I'm asking a rather dumb question here, but anyway :)
I'm currently thinking about how to renew an admin/EAP certificate on an ISE node and the effect on the endpoint authentication.
Here's the thing I do, when I initially install an ISE node
1.) CSR creation on ISE (PAN) - CN=$FQDN$ and SAN="fqdn as well"
2.) Sign CSR and bind certificate on ISE node - done
Now after 10 month or so (if the certificate is valid for one year) I want to renew the ISE admin/EAP certificate.
CSR creation: I cannot use the $FQDN$ as the CN, because there is still the current certificate (CN must be unique in the store, right?)
So what to do now? Do I really need to create a temporary SSC and make it the admin/EAP certificate, delete the current certificate and then create a new CSR? There must be a better and more important non-disruptive way of doing this.
How do you guys do this in your deployments?
Thanks in advance and sorry again if this is a silly question.
Johannes

you can install a new certificate on the ISE before it is active, Cisco recommends that you install the new certificate before the old certificate expires. This overlap period between the old certificate expiration date and the new certificate start date gives you time to renew certificates and plan their installation with little or no downtime. Once the new certificate enters its valid date range, enable the EAP and/or HTTPS protocol. Remember, if you enable HTTPS, there will be a service restart
Certificate Renewal on Cisco Identity Services Engine Configuration Guide
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116977-technote-ise-cert-00.html

Admin Node Hanging when Monitoring Cluster in Console

          I'm running into a very unusual situation with my cluster. The administrative node
          is failing. I'm running all of my nodes as background services. The admin node
          usually fails after about an hour. That's usually after all of the nodes are completely
          up.
          The only application deployed to the admin is the console.war. I typically will
          log into the console and monitor the progress of all of my managed nodes starting.
          I typically go to the server tab a watch all of my nodes change from Red to Green.
          I do this by clicking the refresh icon. It refreshes every ten seconds. Once I
          close my browser and reattempt to log back into the console, it ends up hanging.
          I log onto the server and notice that there are no errors in my log files, and
          that the beasvc.exe is still running for the admin. All indications are that it
          is running. The only way to resolve the issue is to kill the service and restart
          it. I've tried to replicate this in the foreground, but I get a similar error.
          The admin node fails and in the dos command window, I get the following error
          at the bottom of my thread dump:
          "# An unknown exception code exception has been detected in native code outside
          the VM. # Program counter=0x77fb16cc"


JDK 1.3.1_02 is certified for WLS 6.0 SP2 on Solaris only.
          Kumar Allamraju wrote:
          > what version of JDK?
          > I presume you are using the JDK s hipped with WLS.
          > If yes, we have seen JVM crashing at other customer sites.
          >
          > I would suggest you to try a new JDK (preferably 131_02) and see
          > if that makes any difference. Until we see thread dumps we cannot
          > really figure out the problem in WLS, so pls make sure that the JVM
          > is not crashing.
          >
          > --
          > Kumar
          >
          > Steve Feldman wrote:
          >
          > > I'm running into a very unusual situation with my cluster. The administrative node
          > > is failing. I'm running all of my nodes as background services. The admin node
          > > usually fails after about an hour. That's usually after all of the nodes are completely
          > > up.
          > >
          > > The only application deployed to the admin is the console.war. I typically will
          > > log into the console and monitor the progress of all of my managed nodes starting.
          > > I typically go to the server tab a watch all of my nodes change from Red to Green.
          > > I do this by clicking the refresh icon. It refreshes every ten seconds. Once I
          > > close my browser and reattempt to log back into the console, it ends up hanging.
          > >
          > >
          > > I log onto the server and notice that there are no errors in my log files, and
          > > that the beasvc.exe is still running for the admin. All indications are that it
          > > is running. The only way to resolve the issue is to kill the service and restart
          > > it. I've tried to replicate this in the foreground, but I get a similar error.
          > > The admin node fails and in the dos command window, I get the following error
          > > at the bottom of my thread dump:
          > >
          > > "# An unknown exception code exception has been detected in native code outside
          > > the VM. # Program counter=0x77fb16cc"
          > >
          Rajesh Mirchandani
          Developer Relations Engineer
          BEA Support

ISE admin server with 16 character hostname

Our ISE admin servers were inadvertently built with 16 character hostnames. Active directory has a 15 character limit for hostnames. This causes the 16th character to be truncated. The secondary admin server fails to connect to AD because the hostname no longer looks unique. Is there a work around for this other than rebuilding the ISE servers?

Hi Jeff,
you need not rebuild your entire ISE nodes. You have to follow the below steps.
Changing the Hostname or IP Address of a Standalone Cisco ISE Node
You can change the hostname, IP address, or domain name of standalone Cisco ISE nodes. You cannot use “localhost” as the hostname for a node.
Before You Begin
If the Cisco ISE node is part of a distributed deployment, you must remove it from the deployment and ensure that it is a standalone node.
Step 1 Change the hostname or IP address of the Cisco ISE node using the hostname , ip address, or ip domain-name command from the Cisco ISE CLI.
Step 2 Restart the Cisco ISE application configuration using the application stop ise command from the Cisco ISE CLI to restart all the services.
Step 3 Register the Cisco ISE node to the primary Administration node if it part of a distributed deployment.
Note If you are using the hostname while registering the Cisco ISE node, the fully qualified domain name (FQDN) of the standalone node that you are going to register, for example, abc.xyz.com must be DNS-resolvable from the primary Administration node. Otherwise, node registration fails. You must enter the IP addresses and FQDNs of the Cisco ISE nodes that are part of your distributed deployment in the DNS server.
After you register the Cisco ISE node as a secondary node, the primary Administration node replicates the change in the IP address, hostname, or domain name to the other Cisco ISE nodes in your deployment.
Make sure that you also update the DNS record with new hostname and replace the certificate unless you are using wildcard cert.

Log files under the admin node are getting filled up

I installed Sun One Web Server 7.o u3 in the following way:
a. Installed admin server on MC1
b. installed admin node on MC2.
c. When I started MC1 and MC2, the access log file (C:\Program Files\Sun\WebServer7\admin-server\logs) under the admin node MC2 is getting filled up with these messages for every 2 minutes:
MC1 IP ADDRESS - CN=admin-client-cert [24/Mar/2010:18:03:46 -0400] "POST /jmxconnector/remotejmx HTTP/1.1" 200 291
I checked for errors file under the admin server, and I did not see any errors, as such. Please help me to fix the problem. I installed node and server, as per guidelines
I have not installed any web app or deployed any config.
Thanks,
Phani

Joe,
That worked. Thanks a lot. 1 more thing. I made a new configuration, while migrating 6.1(SP2) instances.After deploying on MC1/MC2, and when I am trying to start the configuration on the instances, it is giving the following errors for both nodes MC1 & MC2:
ADMIN3584: Error while starting the server. Please check the server logs.
I ran the log mode with 'finest' level and it is showing following exceptions:
25/Mar/2010:17:55:28] fine ( 6044): for host 10.248.131.38 trying to POST /admingui/admingui/startInstances, service-j2ee reports:
com.sun.web.admin.exceptions.AdminException: ADMIN3584: Error while starting the server. Please check the server logs.
     at com.sun.web.admin.mbeans.AgentMBean.startServer(AgentMBean.java:212)
     at com.sun.web.admin.mbeans.AgentMBean.startServer(AgentMBean.java:198)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
[25/Mar/2010:17:55:28] info ( 6044): for host 10.248.131.38 trying to POST /admingui/admingui/startInstances, service-j2ee reports: Exception : ADMIN3011: The operation failed with errors on the following nodes:
Node 'MC1.test.com':
ADMIN3584: Error while starting the server. Please check the server logs.
[25/Mar/2010:17:55:28] fine ( 6044): for host 10.248.131.38 trying to POST /admingui/admingui/startInstances, service-j2ee reports:
com.sun.web.admin.exceptions.MultiNodeException: ADMIN3011: The operation failed with errors on the following nodes:
Node ''MC1'
ADMIN3584: Error while starting the server. Please check the server logs.
     at com.sun.web.admin.mbeans.NodeMBean.doLifecycleAction(NodeMBean.java:84)
     at com.sun.web.admin.mbeans.NodeMBean.startServer(NodeMBean.java:299)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
     at com.sun.web.admin.mbeans.BaseAdminMBean.invoke(BaseAdminMBean.java:49)
     at
Any help on this issue is appreciated.
Thanks,
Phani

Customer Master replication error from R/3 to CRM

Experts,
I am trying to replicate Customer Master from R/3 to CRM.
All the settings have been done. Nothing shows up in Queues. However, Bdoc hangs in "Received" state.
When I try to reprocess the Bdoc, I get a prog dump of type DBIF_RSQL_INTERNAL_ERROR in below function module: CRM_BUPA_FRG0020_SAVE_TABS
at INSERT crmm_but_set0020 FROM TABLE it_set0020_insert[]
This data corresponds to Shipping data in Customer Master.
Can you please help? I saw a similar thread in the forum where there was a suggestion about R/3 plug in update. How can I do that?
Thanks in advance,
JD

Pls see Customer Master replication error
Closed.

Invalid I/O node config error while passing project reservations to APO

Guys,
I had created a Project with WBS Element, Network & Internal activity in ECC Project Systems. This data was ciffed and seen in APO without any issue.
Upon creating a Material component, as a reservation, under network activity in PS and releasing it, there is an error in the APO side log(SLG1) as shown below.
Source system: xyz, user: abc transaction:CJ20N function module:/SAPAPO/CIF_PRJ_INBOUND
-----Error start--
New order (warning)
Error in activity of operation 0010 order 4001740(warning)
Invalid I/O node configuration (error)- Message no. /SAPAPO/OM_ERROR258
Diagnosis-The I/O node cannot be scheduled using the value combination specified.
--Error end--
Error while processing project order: 000001234- (error)- Message no. /SAPAPO/PRJ003
------Log Information
The registered objects of the queue are marked as faulty - Message no. /SAPAPO/CIF_ERRHDLG604
CIF error handling activated - Message no. /SAPAPO/CIF_ERRHDLG504
End of processing registered for RFC 00000001 of the LUW with ID xxx
Message no. /SAPAPO/CIF_ERRHDLG605
checked the APO post processing and manaully triggered the transfer of selected order . even then order reservation wasn't pushed to APO.
Would appreciate if any one can provide with info on why this error is being produced and ways to resolve it!!!
Thanks

please check if you have any issues under network activity..if you could not find any please try to debug the failed queue with the help of your Abap counterpart. here is the process
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/d0d1265d-db32-2b10-79ba-ccf6fe2c161d

Replication error BP from CRM to R/3 - "Fill in all required entry Fields"

Dear Folks
I have maintained all steps mentioned in building block - C03. I have maintained separate account group approach. Made sure that number ranges are in sync in both the systems. Particularly in PIDE, mapping classification Consumer-Org 'A' to 'ZZ01' (Copy of 0001).
      I changed all required entry to optional entry in my 'ZZ01' field status using OVT0.
       But when i replicate using R3AS, i get an error 'Fill in all required entry Fields" - Error in receiving system (i.e R/3).
       I tried manually creating customer in R/3 with the account group ZZ01. Surprisingly it does not allows me to save unless i give the reconcillation account entry, even though it is not a required field.
   Please let me know for further details and Please help me to resolve this error. I am in real urgency.
Thanks
Keerthi
Chicago IL
507 401 1030

Hi Karunakaran
        Your reply answered my question of creating customer with no 'recon' a/c required entry. Thanks awarded 2 points.
          My replication error is still hanging around. I found that It has no bearing on the 'Reconcillation A/c' required entry.
          Some other field is still restricting my BP Role- Consumer:Organization to replicate. The error still showing as "required fields are not entered in R/3", even after suppressing "Reconcillation Account".
       I think my reference customer master i created in R/3 using VD07 is not assigned in case of the account group Consumer:Organization.
   But i don't know how to verify my doubts and get rid of this error.
Please help, in great urgency.

OSx not recognized. Invalid node estructure error but Windows 7 partition works perfectly. All tests done but still don't know what is wrong

I have an Imac Snow Leopard 10.6.3 1TB hard drive , it has a partition of 100gb for Windows 7 using Bootcamp (only for games)
The computer was kind of slow one night. The next day it was so terrible slow that I decided to restart it, but it never showed OSX again. If I try to boot into single user mode it shows Windows Boot Manager. Even booting with alt only shows Bootcamp Windows. Is like OSX dissapeared.
I tried Disk utility and it showed an "inlavid node structure" error, "Disk Utility cannot repair this disk"
I also used Diskwarrior, the test was relatively fast and showed this at the end "Disk Warrior has successfully built a new directry for the disk. The new directory cannot replace the original because of disk Malfunction. Disk Malfunction is a failure of or damage to any mechanical component of the disk or any component connected to it"
I also did a S.M.A.R.T. test from diskwarrior which turned out ok
I used Apple Hardware test, (booting with D and the Applications DVD). It goes through several things, even logic board but when it reaches "testing in progress" almost at the end it gets stucked. I have tried the simple and complete test in many different ways, with mouse, without, everything disconnected, it doesnt matter, clicking the "Stop Testing" button or using cmd+period (as instructed on screen) doesn't stop the test. The "Total Time Testing" field also stops counting. I have to force shut down with the power button every time.
But here comes the most odd part of this story. The computer now almost always boots in the Windows 7 partition which works perfectly. I can chat, use viderocamera, save, delete, listen to music, watch videos, etc.... I even enter from Windows all my MAC Archives and backuped almost the 900Gb I had with no problem (great thing to use Bootcamp, never imagined it will be this useful).
So my question is, WHATS WRONG? The hard drive? the logic board? the fan? I need to know in order to buy the replacement. I have no warranty anymore and would like to fix it myself.
Please help me understand what is going on

RESOLUTION:
I erase the drive completely following the security measure "Zero Out Data" and then reformat the drive. According to what I read, by following the zero out data procedure, the computer checks the drive and isolates possible structural errors in the disk ( don´t know if it is true) I had everything already backup through Windows as explained originally.
After I reformat the drive everything is working OK. I have done the tests again (Disk Utility and Disk Warrior) that showed the drive to be in perfect order. So probably the error was caused by lack of sufficient free space in the disk ( 30 highly fragmented GB for a 1TB computer) that made OS X incapable of handling new information and was deleting key elements (?) in short a fragmented and saturated disk. However still do not understand why most tests could not complete or showed info relating to structural damage and now the same tests are saying everything is OK...
So if anyone goes through something similar, try erasing and formatting the drive, see how it goes.
Thank you very much baltwo!

ISE Admin node Replication error

Similar Messages

Maybe you are looking for