topic Re: I have two ISE nodes, admin in Network Access Control

Cisco ISE GUI slow and unresponsive

Cobhamuser1 — Mon, 11 Mar 2019 07:31:16 GMT

I am increasingly finding ISE unresponsive, when moving between tabs on the GUI

Often it takes a while to connect, followed by peroids where pages are not loading

Then it will be fine

Checks on my VM shows no over utilisation

Checks on the ESXI host show no issues

I have a local ISE, so not impacted by WAN

Are there any known issues with version 2.1.0.474

Thanks

Simon

Hi

andrewswanson — Mon, 06 Mar 2017 16:27:23 GMT

what patch version of 2.1 do you have installed? Do you have the ERS enabled (e.g. for Prime Infrastructure integration)?. Also, have you tried a different browser?

hth

Andy

Hi Andy

Cobhamuser1 — Mon, 06 Mar 2017 21:01:31 GMT

Hi Andy

I am running 2.1.0.474

I have not enabled the ERS setting but I have pointed my Cisco Prime at ISE?

I have tried various browsers, most of the time firefox is okay but periodically its horrendously slow

Thanks

Simon

Hi Simon

andrewswanson — Mon, 06 Mar 2017 22:24:50 GMT

Hi Simon

There are 3 released patches for ISE 2.1. If you run the command "show application version ise" from the appliance command line you will see what if any patches are installed. Release notes for patch 3 is below:

http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/release_notes/ise21_rn.html

I'm not sure what you mean by pointing Cisco Prime at ISE but if you have ERS enabled for ISE/Prime integration there is a bug CSCvc40801 (ISE MnT sluggishness and high I/O when integrated with Prime Infrastructure) which is sorted with patch 3

hth
Andy

ps I assume you have a single ISE node acting as the PAN/MnT/PSN?

I have two ISE nodes, admin

Cobhamuser1 — Mon, 06 Mar 2017 22:49:35 GMT

I have two ISE nodes, admin/monitor

No patches installed

Cisco Identity Services Engine ---------------------------------------------

Version : 2.1.0.474 Build Date : Wed May 25 04:34:43 2016

Install Date : Mon Aug 8 14:31:56 2016

I have x2 deployments, in two regions. Only one is Prime integrated using the following link. I didn't see anything about ERS

https://supportforums.cisco.com/discussion/11829631/ise-and-pi-integration

As another thought I do have integration with Airwatch MDM in both deployments. I have a feeling this sort of ties in with possible slow down

Seems like I need to patch my deployments, maybe Airwatch causes a similar problem, I will read the links

Re: I have two ISE nodes, admin

tom.wilcox@cdtfa.ca.gov — Tue, 07 Nov 2017 22:50:13 GMT

Did you get this resolved? I'm curious because we are having a similar issue even after patching.

Re: I have two ISE nodes, admin

Alex Pfeil — Thu, 18 Jan 2018 15:06:56 GMT

Did you ever get this resolved?

Thanks,

Alex

Re: I have two ISE nodes, admin

tom.wilcox@cdtfa.ca.gov — Thu, 18 Jan 2018 15:22:08 GMT

We're running 2.2.0.470 patches 1,2,4
We're still working with Cisco Professional services to iron out a lot of client side issue to resolve authentication error messages.
Slowness issues in our case were resolved to some degree by patch 2 if I remember correctly, but also by working to resolved some client software issues (turning off NIC sleep among other things) where our logs were being overwhelmed by repeated authentication failure / retries; all this being said we still are in monitor mode and haven't put this into production due to further tuning that's being done.

Re: I have two ISE nodes, admin

Alex Pfeil — Thu, 18 Jan 2018 15:26:08 GMT

Thank you for the quick response. I will take a look at our policy on the power saver settings of the wireless NIC cards. Please send another update when you can. Just curious, what physical\virtual appliances are you running?
Thanks,
Alex

Re: I have two ISE nodes, admin

tom.wilcox@cdtfa.ca.gov — Thu, 18 Jan 2018 17:22:04 GMT

There's a document floating around somewhere that discusses the client side issue related to tuning I found a link to it on the forums a few months ago.
One of the keys for us up to this point was reducing the high average load alarms.
We've found this post extremely helpful:

https://supportforums.cisco.com/t5/security-blogs/getting-past-intermittent-unexplained-802-1x-problems-on-windows/ba-p/3104109

Re: I have two ISE nodes, admin

marksilva — Sat, 03 Mar 2018 01:57:43 GMT

Quick question though, generally where can you see the uptime etc in GUI?

Re: I have two ISE nodes, admin

PETER LUNDKVIST — Sat, 23 Mar 2019 23:49:38 GMT

Can you check that link address, it´s not working and I am very interested in that document. Thanks.

Re: I have two ISE nodes, admin

hslai — Sun, 31 Mar 2019 00:53:20 GMT

@PETER LUNDKVIST wrote:

Can you check that link address, it´s not working and I am very interested in that document. Thanks.

Getting past intermittent/unexplained 8... - Cisco Community seems what you are interest in.

Re: I have two ISE nodes, admin

Andrii Oliinyk — Thu, 31 Dec 2020 11:57:00 GMT

Article Not Found

;0)