topic ISE installation problem in Network Access Control

ISE installation problem

Kashish_Patel — Mon, 11 Mar 2019 02:24:10 GMT

Hi Security Experts,

We got two new ISE 3315 boxes for our datacenter today.

When I went on to do installation for them, I am facing weird problem. I see weird characters/misspelled words. I have tried rebooting the box with no help and the issue persisted after reboot as well. I also tried to boot them from DVD and even the BIOS boot options are all weird. Problem I am facing is that I type some character and it appears as a totally different character on terminal Has anybody seen similar issue? If so, what is the workaround? I have configured Cisco recommended console settings for ISE.

**********************************************

Please!type 'seuup'(to configure thm appmiance

**********************************************

localhost login:

ISE installation problem

Tarik Admani — Thu, 09 Aug 2012 13:08:33 GMT

Kashish,

Can you try with keyboard monitor? Also are you using putty or hyperterminal for you console connection?

thanks,

Tarik Admani
*Please rate helpful posts*

ISE installation problem

Kashish_Patel — Thu, 09 Aug 2012 13:15:48 GMT

We don't have a keyboard monitor setup in the datacenter. I have tried both putty and hyperterm.

ISE installation problem

edondurguti — Fri, 10 Aug 2012 16:12:38 GMT

what kind of serial cable are you using? is this RJ45 to DB9?

I had the similiar problem and I needed to use DB9----DB9 on both ends, then I had db9-usb to connect to my laptop since I didn't have a db9 serial port on my laptop.

Hope it helps

ISE installation problem

Kashish_Patel — Sat, 11 Aug 2012 20:12:05 GMT

Yes I am using a DB9-to-RJ45 cable.

I will check if we have a DB9-to-usb cable because no db9 port on my laptop as well.

Thanks for the tip.

ISE installation problem

Tarik Admani — Sat, 11 Aug 2012 20:45:46 GMT

Also try changing the com port on your workstation just for grins.

ISE installation problem

Kashish_Patel — Mon, 13 Aug 2012 17:41:06 GMT

I tried with keyboard monitor, that worked!

Installation of one of the box was successful, however for the other box, I am seeing issue.

While doing initial installation, I see Ping to gateway failed and subsequently "ntp sync issue".

On the switch, I see interface connected to ISE as up and mac address of box is also learnt, however, installation always shows the above problem.

I tried booting it from dvd. I press F12 and I see first option as "DVD/CD". I select that, but it goes to "setup" again and I again see "Ping to gateway failed" and "ntp sync". I am using keyboard, monitor. How to boot from dvd?

ISE installation problem

edondurguti — Mon, 13 Aug 2012 17:45:21 GMT

That means it's unable to contact the gateway you specified (if you specified) when you set it up, ntp sync meaning it cannot sync with the ntp you provided.

if you can login with your username or anything, type, show running-config and see what is the ip and default-gateway, make sure it's connected and reachable.

ps.

if you are doing this in HA deployment then you need to set the same passwords on both appliances so their databases can sync.

ISE installation problem

Tarik Admani — Mon, 13 Aug 2012 21:34:45 GMT

Also you might want to check the interface status, there was a point where a few 3315 were shipped where the interfaces were swapped. If you had the expansion NIC cards the gig0 was not on the same port as it was on the other ise appliances. The workaround for this was to reimage the box and reconfigure.

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE installation problem

edondurguti — Mon, 13 Aug 2012 21:52:22 GMT

thnx for your input so far, I highly doubt it's a physical issue, since the iphones are being profiled based on their dhcp request, i've even set the dhcp class identifier on my pc to "test" and set a profile attribute with certanity of 100 still nothing... will dig in tomorrow... i have two hours of sleep

ISE installation problem

Kashish_Patel — Tue, 14 Aug 2012 06:25:56 GMT

Hi Tarik,

I can log in to the box but it just doesn't ping the gateway. Other ISE box has also the same default gateway set and that is working fine. On the switch where it is connected, I can see the mac address is learnt, but no arp entry. I have checked config of both ISE boxes and they are same. Switchport config is also same. What am I missing?

Thanks,

Kashish

ISE installation problem

Tarik Admani — Tue, 14 Aug 2012 06:29:01 GMT

Kashish,

If you issue the show interface gig 0 from the cli of ISE do you see the ip address? If not, then work your way to show interface gig 1...etc I think you might be running into the issue where nic cards may have been swapped when the machine was imaged from the factory.

Let me know what you find.

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE installation problem

Kashish_Patel — Tue, 14 Aug 2012 06:54:07 GMT

Yes I see IP under "show run" for interface gig0. All the other interfaces (gig1,2 and 3) are shutdown. I see the link lights on ISE gig0 interface...

I am confused about "I think you might be running into the issue where nic cards may have been swapped when the machine was imaged from the factory." Could you please give me more details about this problem?

ISE installation problem

Tarik Admani — Tue, 14 Aug 2012 06:58:31 GMT

Disregard my initial assumptions, the ip address would have been assigned to a different interface instead....however can you please post the results of show ip route and show interface gig 0?

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE installation problem

Kashish_Patel — Tue, 14 Aug 2012 07:10:47 GMT

isehyd1/admin# sh ip route

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

10.240.161.48 0.0.0.0 255.255.255.240 U 0 0 0 eth0

0.0.0.0 10.240.161.49 0.0.0.0 UG 0 0 0 eth0

isehyd1/admin# sh int gigabitEthernet 0

GigabitEthernet 0

Link encap:Ethernet HWaddr 5C:F3:FC:25:CF:EA

inet addr:10.240.161.55 Bcast:10.240.161.63 Mask:255.255.255.240

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

Interrupt:169 Memory:e8100000-e8110000

ISE installation problem

Tarik Admani — Tue, 14 Aug 2012 07:14:38 GMT

Kashish,

Even though the link is up and you verified that the port configuration is correct is the mac address learned on the right vlan? It is really odd how there isnt any packets being transmitted from the nic itself. Can you try changing the cable to see if that changes your luck, or could you try to unplug the ise that works and plug that cable into this ise and see it if can ping?

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE installation problem

Kashish_Patel — Tue, 14 Aug 2012 07:23:42 GMT

Hey Tarik,

I just happened to check that the mac address learnt by the switch is that of interface gi2 and not of gig0

* 305 5cf3.fc25.cf4e dynamic Yes 1200 Gi2/47

isehyd1/admin# sh int gigabitEthernet 2

GigabitEthernet 2

Link encap:Ethernet HWaddr 5C:F3:FC:25:CF:4E

And I do see some RX bytes and TX bytes.

Thanks,

Kashish

Re: ISE installation problem

Tarik Admani — Tue, 14 Aug 2012 07:30:11 GMT

Kashish,

Did you connect the correct port? Here is the rear panel documentation...if this is connected to the correct port, please reimage the device and everything will come back up correctly. I am trying to find the bug ID that shows the nic issues.

Rear panel (port 7) - http://www.cisco.com/en/US/docs/security/ise/1.1.1/installation_guide/ise_ovr.html#wp1094634

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: ISE installation problem

Tarik Admani — Tue, 14 Aug 2012 07:36:31 GMT

Kashish,

Here is the bug that I was talking about - http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtz03349&from=summary

Tarik Admani
*Please rate helpful posts*

ISE installation problem

Kashish_Patel — Tue, 14 Aug 2012 08:46:37 GMT

Thanks Tarik.

I seem to have resolved the issue. I have connected the cable to a different port now ( though assigned IP to gig0).

Thanks for your help on this.