ISE bandwidth advise

I am facing hardtime regarding ISE latency and bandwidth. We have 2 DC and 2500 endpoint for basic AAA.Please on how to calculate ISE latency and bandwidth

you can download ISE bandwidth and latency calculator here
ATP Partner Resource Center
http://www.ciscosecurityatp.com/login.asp?strReturn=/index.asp

Similar Messages

Music popping up on teachers machines

I am a network administrator and have had complaints from teachers that all of a sudden a small box appears on the screen and music starts to play and they cannot turn it off. A couple of teachers had to reboot their machine to stop it. How does this happen and how can we stop it? Thanks for any help.

Hi,
right... if i understand that document correctly... i need to make sure that I redirect tcp 80 & 8905 to the ip of my Policy node.
8905 was in the re-direct ACL, but 80 was not (this has not caused me an issue in the past). So i have added it in now and that has made no difference.
interestingly though, the document says that the client should be able to resolve the DNS name of the ISE. Now... this bits interesting... when i open command prompt and ping the FQDN of the ISE, it advises that it cannot find the host. BUT if i do an NSLOOKUP and type in the hostname of the ISE, it does reply with a valid IP.
So to me it is something to do with either DNS, or the redirect ACL not allowing DNS to work properly.
The redirect ACL is quite large... is there are way that I can easily export it so that you can have a look at it?
Thanks
Mario De Rosa

Hi any advise on regarding bandwith for ISE nodes (DC & DR)

Hi any advise on regarding bandwith for ISE nodes (DC & DR)

Refer
Bandwidth Requirements for Distributed Deployments
http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_50_ise_deployment_tg.pdf

ISE: advising users that only EAP-TLS can be used

A large school board accepts only EAP-TLS connections. This requirement is easily dissiminated to teachers, however not to students whose personal devices keep trying to connect using PEAP.   Once users connect with EAP-TLS, they are authenticated on AD.
1. Could we from the Switch port block PEAP but let EAP-TLS go through? I couldn't find a command for this.
2. If we can't stop PEAP requests from reaching ISE, could we treat the PEAP connections as CWA, but have a special Authorization Rule that would say if inner tunnel is PEAP then do CWA-nonEAP-TLS web authentication which would be a customized web page that would have a message instructing the students how to use EAP-TLS? would that make sense?
3. Do you have better suggestion how to either block PEAP before it reaches ISE or a way using ISE to let users know that they must use EAP-TLS, not PEAP if they wish to connect?
Thanks.
Cath.

Hi Tarik,
Of course, I know about the Allowed Protocol which currently has only Host Lookup and EAP-TLS enabled. But that technique, of not allowing PEAP in ISE Authentication policies, doesn't stop thousands of students devices from hitting ISE with PEAP traffic. Students have heard that they are allowed to connect to the school network using dot1x, so they turn it on on their PC without regards of to which EAP flavour they are supposed to use. Thus, the ISE box getitng hit with PEAP requests which it drops. The school board would like to deal with that PEAP traffic.
To alliviate this problem, of the ISE box getting constantly PEAP traffic from the same device over and over again in the course of a day, I was wondering:
1. can we stop PEAP traffic before it arrives to ISE? is there a way for the switch to differentiate that it's a PEAP and not EAP-TLS and to drop it before passing it to ISE? I don't think so.
2. if the switch can't stop PEAP , how is the best way to have ISE process the PEAP traffic?   because if ISE only reject the PEAP traffic, it is constantly hit back that the same device sending over and over PEAP traffic to ISE.
I suggested to the client the two following possible ways:
a. authorization rule based on Network Access: Tunnel PEAP that provides CWA with customized webpage telling the students to use EAP-TLS and not PEAP (this technique is explained in para 2. of my original posting).
b. create a blackhole VLAN where the students personal PC that are arriving with PEAP are put. This VLAN doesn't go anywhere, but at least the PC has stopped hitting ISE with PEAP traffic for a few minutes, until the student decides to restart his/her connection.
I also recommended to the client that they have a better technique to inform the students that only EAP-TLS is available, like posters on the wall, blast email, on School FB page, etc . but information dissimination is not an IT problem, it's a communication problem.
Looking forward to your suggestions.

ISE 1.2.1 support for Yosemite?

Hello all, just curious. I see in the release notes for ISE 1.2.X that support for Mac OS 10.10 (Yosemite) was available via patch 12 on the ISE1.2.0 train of code. That said, I see nothing in the release notes stating any support for Yosemite for any of the patches for ISE1.2.1, the latest being patch 3 released 1 week after ISE 1.2.0 patch 12. Can anyone please advise if Yosemite is in fact supported on 1.2.1 with patch 3??
Thank you very much in advance for your help
Jeff

Jeff,
OS X 10.10 is supported in ISE 1.2 p11, 1.2.1 p2 and 1.3.
Patch 12 for 1.2 and Patch 3 for 1.2.1 fix other issues for OS X 10.10, and I recommend updating to the latest patches for these fixes.
Here is the entry in the Release Notes detailing the fix for 10.10 in 1.2 p 12:
MacOsXAgent versrion 4.9.5.3 should be used and MacOsXSPWizard 1.0.0.30
Note that the description for these files denote ISE 1.2 Patch 11/12, ISE 1.3 release and above. ISE 1.2.1 is not mentioned, but follows the bug fix/release schedule for 1.2, with an adjustment.
1.2 patch 10 = 1.2.1 patch 1
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE 1.2 to 1.3 upgrade

I have ISE 1.2 running would advise if we can update to ISE 1.3.I came to know that we have licensing change in 1.3 do i need to buy new license or how is it going to work. Are their any major bug in ISE 1.3 (do want any issues, my 1.2 is stable)

ISE license change is from 1.2 patch 8. You can upgrade from 1.2 to 1.3 and your existing license in 1.2 will move to 1.3
Before You Begin
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/upgrade_guide/b_ise_upgrade_guide_13/b_ise_upgrade_guide_13_chapter_011.html

Remote Access VPN posturing with Cisco ISE 1.1.1

Hi all,
we would like to start using our ISE for Remote VPN access.
We have run a proof of concept with the ISE & IPEP with a Cisco ASA5505. We got the authentication working however posturing of the client did not work.
That was a few months ago and so I was wondering whether any design document is available specifically around Using the Cisco ISE for Authenticating & Posturing Remote Access VPN clients.
I understand that version 9 of the ASA code is supposed to eliminate the need for Inline Posture, does anyone know whether this will also allow posturing too?
We do intend to by Cisco ASR's aswell, but I am sceptical of this as i do not know how many VPN licenses you get out of the box. The ASA's we have allow up to 5000 IPSec VPNs without having to purchase any licensing. What I do not want to do is to switch to SSL VPNs as this again will increase cost.
I know ISR's are support NADs but what about ASRs? There is no mention.
Any advise will be appreciated!
Mario

OK, I have come accross the Cisco Validated design for BYOD and in there it has a section about Authenticating VPNs.
thats great... however it does not mention using the Inline posture node. Does anyone know if there is a limitation using Inline Posture and SSL VPNs...?
essentially my requirements are
2-factor authentication VPN using a Certificate & RSA Token
Posturing of the VPN endpoint.
Ideally i would like to use IPSec VPNs as i have licenses already for these on my ASAs. But if it will only work with SSL & AnyConnect, then so be it.
Can anyone help?
Mario

How to set up a QOS on 3750 switch to limit outbound bandwidth on a server ?

Hi,
I have three LAN ports on a VM server. I want to limit a VM guest (guest server) outbound bandwidth to 3750 swith .
How do I do it ? I want to apply QoS on the switch.
thanks

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
If you're looking to limit bandwidth FROM your server, you can use an ingress policy on the server's interface and police selectively. For example, if your specific VM has its own IP address, you could police inbound (from the server) traffic matching that IP.

How do i extend the bandwidth of my system

The control problem I am having is extending the bandwidth of a force control system. The system is used to apply mechanical load to bone to facilitate research into Osteoporosis. The following concisely describes the system and the different things I have tried to solve the problem,. I imagine it is quite lengthy compared to the usual questions but any advice you have to offer to a Mechanical engineer would be much appreciated.
System Description:
I am using Labview (with Flex motion) to program the NI 7344 motion control servo board (PID update rate of 62.4 micro-seconds). This output signal is then amplified by the MID 7654 power amplifier, supplying current to a Voice coil (this can be considered as a Linear DC motor with a bandwidth of 40Hz). This applies the force to a bone sample. Feedback is then provided by a load cell and connected to the ADC feedback channel of the servo board. (For full specs of all mentioned components please refer to the web links which are listed at the end of this email!)
Problem description:
After optimally tuning the PID characteristics and defining the amplitude and pre-load, I can successfully control a continuous, sinusoidally varying force (frequency 1Hz), however when I try to increase the frequency to 10Hz, the amplitude of the output waveform is marginally reduced�i.e. there is attenuation. I know that the bone sample is not viscoelastic enough to act as a low pass filter. The bandwidth of the Voice coil is not a limiting factor either, so�..
How do I extend the bandwidth of this system?
The following Paragraph describes some of the things I have tried, which have had some or no influence. Being a mechanical engineer I would be grateful for any expert advice.
(Note all results have been verified with an oscilloscope where applicable)
Influential Factors:
1) Method of programming.
To generate the wave form a series of points describing one period are written to a circular buffer on the servo board. The points are executed in 10 milli-second intervals and are splined through using a cubic spline algorithm (hence a period described by 100 points gives us a frequency of 1Hz and a 10 point wave gives us 10Hz). All this happens on the servo board in real time. I am confident that although the integrity of the sine wave is reduced at 10 Hz the amplitude is still described within the 10 points and so is not the reason for attenuation. However this does limit the maximum frequency achievable. (I would say the max frequency is about 20Hz)
2) Redefining the resolution of the of the ADC Feedback
The 12 bit ADC feedback channel is scanned at a rate of 50 micro seconds (faster than the loop update rate which is 62.4 micro-seconds). Initially the voltage range was specified at -/+ 10 V giving 20/(2^12) Volts per significant bit, however I noticed that when I increased the resolution to the max possible by changing the range to 0-5 V (giving 5/(2^12) volts per significant bit), the amount of attenuation was reduced, however there was still some attenuation there. This begs another question why would this factor improve the frequency response???
3) PID characteristics
The system gives an optimum step response when using only a pure integral term and setting Kp= 0, Kd= 0. It seems as though the fastest step response is limited to about 6 milli-seconds. The system is fine tuned and any slight increase in the integral term results in immediate instability. Therefore there is no scope to improve the system bandwidth by altering the PID characteristics.
Can you offer me any expert advice?
Considering this information, what would you advise? Do I need a board with a faster loop update rate ?, I have considered using Labview Real Time, which offers a board with a 26 KHz update rate as apposed to the 16Hz (62.4 micro-seconds) provided by the current board). Do I need to use different control algorithms as apposed to PID, if so which ones???
Any help or advice you have to offer would be much appreciated and could help in the battle against osteoporosis. Should you require more information or would like to speak to me send me an email and I can answer any further questions or give you a ring.
Regards Duncan Webster
Email: [email protected]
Product specs:
Servo board:
http://www.ni.com/pdf/products/us/4mo636-637.pdf
Power amp
http://www.ni.com/pdf/products/us/4mo642-643.pdf

Hi Duncan,
i'm sorry that this answer took this long, but i think a constructive answer which takes a long time is better than a useless answer in a short time....
For the following thought-provoking impulses we have to consider the signal-change when increasing the frequency. The points which describe the signal get streched over the period. Increasing the frequency enlarges the distance between the points.
a) The spline algorithm could be the problem here hence the signal does not correctly pass through the points anymore with increased frequency. Therefor the amplitude decreases with increased frequency. Perharps another kind of spline algorithm can be helpful.
b) Another point can be the control deviation. Since a feedback control system needs a devia
tion for the control, the deviation gets larger when increasing the frequency of the controlled loop. Maybe the control loop has to set the desired value when already getting to a new point. So the signal could get "washy" and the maximum amplitude is reduced.
In this case, the "Velocity Feedforward"-parameter could be of use. This parameter is to use with caution for it can have similar effects like a too high chosen integral term.
c) You can try to set the 7344 to circular contour. Therefor use 2 axis where you use the second axis as dummy (open step). There is a major disadvantage in this setup: since you use 2 axes at the same time, the 7344 can update each axis only with 125 microseconds. But perharps this is sufficient. Either way the parameter of the control loop have to be adapted (integral term reduced).
d) If the 125 microseconds describend in c) is insufficient, you can try to test it with a 7352. The 7352 can handle 2 axis at a time with a update rate of 62.5 microse
conds for each axis.
I hope this answer helps you in solving your rather special issue.
-Norbert
NI Germany
CEO: What exactly is stopping us from doing this?
Expert: Geometry
Marketing Manager: Just ignore it.

ISE 1.2 & AD & Meraki - Per User Group Policy ?

I am working on a PoC for a deployment in an MDU. We are using Meraki switches and access points. There are 250 units in the building, each unit will have it's own subnet. The goal is to have the tenant be able to connect to a common building SSID and be placed into their assigned VLAN. There will also be physical ports in each unit that will need to do the same. I am trying to figure out a way to use ISE to authorize on a per user basis and not based on groups of users. On the Meraki system there are group policies that will assign the VLAN for the user as well as any type of layer 7 firewalling and bandwidth control. So there will be 250 group policies, one for each unit. There is a deployment guide that shows how to setup ISE for use with Meraki and it is great but it assumes that there will be large groups like Employees, Contractors, etc.. that will be used. This is where I'm being tripped up, also... this is my first swing at a NAC deployment so I have a lot to learn.
1.Can I setup each user in Active Directory to have a tag that ISE can then forward on to Meraki for the group policy? Say it's unit 101 and I have a group policy called 101 in Meraki, Meraki documentation says to use the Airespace-ACL-Name attribute in ISE to indicate the group policy to use. This gives me the ability to place a group into that policy but not an individual. Or would this be better done by creating the users in ISE directly? Omit AD entirely?
2. Each unit will have devices that will need MAB because they are not 802.1x compatible. I need to do the same as above with them. I would create a separate SSID for these devices but then use the MAC address to authenticate them but will need to authorize them to go into a specific group policy.
I know this isn't a typical ISE application but I think that this will work really well in the end, just need to iron out these details and get a test system functioning. Any help would be greatly appreciated!!!
Thanks,
Nathan

Please find the Meraki_ISE integration doc. in attachment.
When VLAN tagging is configured per user, multiple users can be associated to the same SSID, but their traffic is tagged with different VLAN IDs. This configuration is achieved by authenticating wireless devices or users against a customer-premise RADIUS server, which can return RADIUS attributes that convey the VLAN ID that should be assigned to a particular user’s traffic.
In order to perform per-user VLAN tagging, a RADIUS server must be used with one of the following settings:
MAC-based access control (no encryption)
WPA2-Enterprise with 802.1x authentication
A per-user VLAN tag can be applied in 3 different ways:
The RADIUS server returns a Tunnel-Private-Group-ID attribute in the Access-Accept message, which specifies the VLAN ID that should be applied to the wireless user. This VLAN ID could override whatever may be configured in the MCC (which could be no VLAN tagging, or a per-SSID VLAN tag). To have this VLAN ID take effect, “RADIUS override” must be set to “RADIUS response can override VLAN tag” under the Configure tab on the Access Control page in the “VLAN setup” section.
The RADIUS server returns a group policy attribute (e.g., Filter-ID) in the Access-Accept message. The group policy attribute specifies a group policy that should be applied to the wireless user, overriding the policy configured on the SSID itself. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.
On the Client Details page, a client can be manually assigned a group policy. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.

NAC Agent Login Dialog Not Appearing - ISE 1.1.1 issue ?

Agent Fails to Initiate Posture Assessment
The NAC agent is properly installed on a Windoes 7 , IE 9 machine, the certificates from ISE ADM PRI are installed in trustable certificate store in the client machine but is a selfsigned ISE certificate.
The reports / USER / Profiling report says the Provisioning Agent has completed the assessment ok.
The redirected URL is working fine (SEE Evidence)
We are always prompted to install the NAC agent again or looking at the additional prompted information wait for the NAC agent to load and complete.
The operations status remains with postering status pending forever and nothing else happens.
Symptoms or Issue
The agent login dialog box does not appear to the user following client provisioning.
Conditions Cisco Says this issue can generally take place during the posture assessment phase of any user
authentication session.
Cisco Advises as Possible Causes There are multiple possible causes for this type of issue. See the following
Resolution descriptions for details of what was already tested by us and please see the atached files for your switch configuration and evidences. .
CISCO SUGGESTED POSSIBLE CAUSES AND RESOLUTIONS
Resolution • Ensure that the agent is running on the client machine. ALL TESTED OK
• Ensure that the Cisco IOS release on the switch is equal to or more recent than
Cisco IOS Release 12.2.(53)SE. - OK
• Ensure that the discovery host address on the Cisco NAC agent or Mac OS X
agent is pointing to the Cisco ISE FQDN. (Right-click on the NAC agent icon,
choose Properties, and check the discovery host.) - OK (See evidence)
• Ensure that the access switch allows Swiss communication between Cisco ISE
and the end client machine. Limited access ACL applied for the session should
allow Swiss ports: ALL CONFIGURED as CISCO GUIDELINES OK (SEE EVIDENCE)
• If the agent login dialog still does not appear, it could be a certificate issue.
Ensure that the certificate that is used for Swiss communication on the end client
is in the Cisco ISE certificate trusted list. (ALL CHECKED OK SEE EVIDENCE)
• Ensure that the default gateway is reachable from the client machine. (TESTED OK)

Hi.
Can you paste all the ACLs on your switch especially the webauth redirect ACL which should deny traffic towards the PSN.
regards
Zubair

Upgrade question for ISE 1.1.1 to 1.1.2 patch 8

Hi everyone,
I need some advise on upgrading from ISE 1.1.1 patch 3 to 1.1.2 patch 8...
I have read the upgrade document on the Cisco website http://www.cisco.com/en/US/docs/security/ise/1.1.1/upgrade_guide/upgrade.html and tried to understand it properly, but I have a couple of questions about it.
Firstly, the procesdures detailed are only relevant if you are upgrading from 1.0 or 1.1 to 1.1.x ( i think )... Well I am already running 1.1.1 and I want to upgrade to 1.1.2 patch 8, so is this document right for me?
Secondly, I would like to follow the procedure for a "Two Admin Node Deployment". But the caveat message and Warning message directly below the diagram worries me as I do not know whether these apply to me...
This supports an upgrade of Cisco ISE, Release 1.0 or 1.1 to Cisco ISE, Release 1.1.x with split domain upgrade only, so that the secondary ISE node has to be deregistered individually from the deployment before upgrade.
As I said, firstly I am not upgrading from 1.0 or 1.1 and secondly, what is a split domain upgrade?
Hope you all can help!
thanks
Mario

Thanks Ravi / Tarik,
so I need to perform a split domain upgrade by following the steps below... (sorry about the formatting)
To perform a two-adminnode deployment upgrade, complete the following procedure:
Step 1
Perform an on-demand backup (manually) of the Primary Administration ISE node from the admin user interface or CLI and an on-demand backup of the Monitoring node from the admin user interface, before upgrading to Cisco ISE, Release 1.1.x.
.Step 2Deregister the secondary node (Node B) from the deployment setup. After deregistration, this node becomes a standalone node.Step 3Upgrade this standalone node to Cisco ISE, Release 1.1.x.When you log in to Node B after the upgrade, if the system prompts you for a license, you must install a valid license for the secondary node based on its UDI. See Obtaining a Valid License, page 1-2 for more information.For more information on how perform an on-demand backup, see the "Performing an On-Demand Backup" section on page 1-3
Step 4Convert the primary node of the previous deployment (Node A) to a standalone node.Step 5Make Node B as the primary node in the new deployment.Step 6Upgrade Node A to Cisco ISE, Release 1.1.x and register to Node B in the Cisco ISE, Release 1.1.x deployment setup as the secondary node.
After you upgrade your deployment, all the policies and other data of the previous deployment will be retained in your new deployment.

ISE 1.2 disable endpoints with certain mac address

Hi All,
We have an AD to authenticate for wireless users. In AD, we have specified to block the user if the password is entered wrongly for more than 3 times. The problem is some of them are using other user ID and locking the accounts. I have gotten the MAC address of the user. Can anyone please advise how to block the request from this MAC from even reaching the AD.
Thanks

You have two options from ISE and one option from the WLC:
The first option which is not very scalable is to modify your authentication policy to deny access to an specific MAC address(Radius:Calling station ID). But this is not very scalable as you can only specify one MAC address.
Your second option is to enable the anomalous client suppression(under systems->settings->protocols->RADIUS). This will be your best option but it would require a bit of testing to identify what are the best values for your environment.
From the controller you can enable the excessive 802.1x authentication failures. By default it won't even send the fourth authentication to ISE for a failing endpoint:

Web Redirection Problem on Cisco ISE 1.2 and WLC 7.5

Hello,
We are at initial phase of deploying ISE 1.2 in our environment for Wireless Guest Users.
I have configured ISE and WLC to talk to each other which is working fine. An SSID with MAC-Filtering is also configured on WLC and ACL only allowing ISE and DNS traffice.
I have configured proper authentication and authorization policies on ISE. Now, when I try to connect my device (laptop and android mobile), I see my device gets associated with the SSID (Demo) and gets the right IP Address from DHCP and right VLAN from WLC. The log process on ISE is as follows.
11001
Received RADIUS Access-Request
11017
RADIUS created a new session
11027
Detected Host Lookup UseCase (Service-Type = Call Check (10))
15049
Evaluating Policy Group
15008
Evaluating Service Selection Policy
15048
Queried PIP
15048
Queried PIP
15004
Matched rule
15041
Evaluating Identity Policy
15006
Matched Default Rule
15013
Selected Identity Source - Internal Endpoints
24210
Looking up User in Internal Users IDStore - B8:B4:2E:A6:7D:75
24216
The user is not found in the internal users identity store
24209
Looking up Endpoint in Internal Endpoints IDStore - B8:B4:2E:A6:7D:75
24211
Found Endpoint in Internal Endpoints IDStore
22037
Authentication Passed
15036
Evaluating Authorization Policy
15048
Queried PIP
15048
Queried PIP
15048
Queried PIP
15004
Matched rule - Guest Redirection
15016
Selected Authorization Profile - Test_Profile
11002
Returned RADIUS Access-Accept
I also see a redirect url in the detailed authentication logs. But the problem is that when I open my browser on my device, it doesn't get redirected to the guest portal url. Now since I can't get there, I can't continue with the rest of the process of authentication, COA and final ACL for internet access.
Can some one please either guide me the correct steps that I need to follow, if I have mis configured something or advise if this is a bug.
Thanks in advance.
Jay

The ACL is definitely used to define what traffic is re-directed to ISE and what traffic is not redirected. Having the permit-all statement at the end will break redirection. If you are using flex-connect then you will need to use flex-connect ACLs and apply those to the flex-connect APs. The links below should give you an idea of what needs to be done:
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113606-byod-flexconnect-dg-000.html
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html
Thank you for rating helpful posts!

Meaning of this error (ISE 1.2 on SNS-3415): HARDWARE RNG INTEGRITY CHECK HAS FAILED!

Hi. We recently purchased an ISE 1.2 appliance (SNS-3415 hardware). It installed fine, but I am unable to access the GUI. When I login to the box and run the following command on the CLI
ISE-12-NS-SD-2/admin# show application status ise
I see the following output:
ISE Database listener is running, PID: 7737
ISE Database is running, number of processes: 38
ISE Application Server process is not running.
ISE Profiler DB is running, PID: 9090
ISE M&T Session Database is running, PID: 8959
ISE M&T Log Collector is running, PID: 9294
ISE M&T Log Processor is running, PID: 9376
% ERROR: ISE SERVICES HAVE BEEN DISABLED BECAUSE
% HARDWARE RNG INTEGRITY CHECK HAS FAILED!
Can anyone help me? What can I do to ensure that the hardware RNG integrity check succeeds. Is it a license issue? Is it faulty hardware? Please advise. I would be very greatful.
Thanks in advance.

I worked with a TAC engineer on this and he said one other customer had this issue and the only recourse was reimaging the appliance with the ISE 1.2 ISO image.
I did reboot, restarted services, reset to factory default and none of that worked. It is possible that the issue happened because during setup of the appliance I didn't have network connectivity and went ahead with the setup and configuration of the ISE application anyway. I later had network connectivity but by that time ISE manifested this fault.
Reimaging and ensuring network connectivity during setup the next time around fixed the problem.

ISE bandwidth advise

Similar Messages

Maybe you are looking for