topic Youre a brave man Marvin :-) in Network Access Control

ISE 2.1 Released

Marvin Rhoads — Mon, 11 Mar 2019 06:50:00 GMT

In case you missed it, the ISE 2.1 update is out as of 31 May 2016.

Here are the release notes. Lots of good stuff packed in this one.

I'm feeling lucky, i might

jan.nielsen — Thu, 02 Jun 2016 20:34:45 GMT

I'm feeling lucky, i might upgrade the first customer next week 🙂

I was getting ready for an

Marvin Rhoads — Thu, 02 Jun 2016 22:13:02 GMT

I was getting ready for an upgrade today and that's how I found the release was out already. 🙂

Node 1 completed, 3 more to go on this deployment...

Version information of installed applications
---------------------------------------------
Cisco Identity Services Engine
---------------------------------------------
Version : 2.1.0.474
Build Date : Wed May 25 04:34:43 2016
Install Date : Thu Jun 2 21:39:28 2016

admin# show application status ise

ISE PROCESS NAME STATE PROCESS ID 
--------------------------------------------------------------------
Database Listener running 30286 
Database Server running 61 PROCESSES
Application Server running 2110 
Profiler Database running 31568 
ISE Indexing Engine running 2711 
AD Connector running 27944 
M&T Session Database running 31476 
M&T Log Collector running 3372 
M&T Log Processor running 3283 
Certificate Authority Service disabled 
EST Service disabled 
SXP Engine Service disabled 
TC-NAC Docker Service disabled 
TC-NAC MongoDB Container disabled 
TC-NAC RabbitMQ Container disabled 
TC-NAC Core Engine Container disabled 
VA Database disabled 
VA Service disabled 
pxGrid Infrastructure Service disabled 
pxGrid Publisher Subscriber Service disabled 
pxGrid Connection Manager disabled 
pxGrid Controller disabled 
PassiveID Service disabled 
DHCP Server (dhcpd) disabled 
DNS Server (named) disabled

Youre a brave man Marvin :-)

jan.nielsen — Fri, 03 Jun 2016 07:00:18 GMT

Youre a brave man Marvin 🙂

Hello,

mvolk — Wed, 15 Jun 2016 10:40:04 GMT

Hello,

I´m on my 2nd migration to ISE 2.1 and I have the problem that here the "ISE Indexing Engine" State is "not running".

Any idea why the prozess is not running!?

Thanks and Regards

Marc

I am told this issue may be

jrabinow — Thu, 16 Jun 2016 04:36:57 GMT

I am told this issue may be related to need to have Reverse DNS lookup configured on node for this to work

More specifically need to add

jrabinow — Thu, 16 Jun 2016 18:08:44 GMT

More specifically need to add PTR records (IP -> DNS name) which correspond to each regular forward A-record (DNS name to IP) for all the NIC(s) on ISE

I ran into the same issue

tgrundbacher — Fri, 01 Jul 2016 20:07:46 GMT

I ran into the same issue today during an upgrade attempt from 1.3 -> 2.1. Seems to be a bug and something for TAC...

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva01828

Hello,

mvolk — Wed, 06 Jul 2016 06:39:57 GMT

Hello,

so we have checked the reverse DNS entrys in the DNS-Servers and add the missed one.

But also between a service restart and an reboot of the 2nd node only the Indexing Service still not running.

The messages in the cli was the same as discribed in the bug CSCva01828.

Any other idea or have I anything not seen that must be configured on ise self.

Thanks!

Did the procedure help

jrabinow — Wed, 06 Jul 2016 07:05:28 GMT

Did the procedure help resolve the problem on one of the servers?

I do not have moer suggestions and suggest you reach out to TAC. Sorry

contact Cisco TAC, need to

Ambuj M — Sat, 16 Jul 2016 17:36:14 GMT

contact Cisco TAC, need to get into root shell to delete one of the duplicate entry from hostname file which is created during upgrade to fix the "indexing service not running" issue.

Hi Marvin,

Guillaume BARBEROT — Tue, 19 Jul 2016 16:21:55 GMT

Hi Marvin,

Any feedback on how many tac case/bugs are opened for this 2.1 release ?

Do you have an estimate date for the first bugfix patch release ?

Thanks

Guillaume

I don't work for Cisco so I

Marvin Rhoads — Tue, 19 Jul 2016 16:32:45 GMT

I don't work for Cisco so I haven't seen the TAC cases. There are open caveats documented in the release notes here:

http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/release_notes/ise21_rn.html#pgfId-631740

I do know of a couple bugs folks have been hitting that weren't published in the release notes but are public-facing: CSCva01828 and CSCva13610.

One of our customers is also seeing a more alarming issue of the ISE RADIUS server not recognizing the NAD (WLC running 8.2 in this case) and we are actively working with TAC to resolve it.

It seems hit and miss whether a given bug will affect your deployment.

According to the speakers at Cisco Live last week,Cisco's goal for Patch 1 on 2.1 is 6 weeks post-release. So it should be out any day now.

They were recommending 2.1 for anyone needing Device Admin as it fixes quite a few things in that feature. If you aren't using that feature, they recommended that 2.0.1 might be a better release for now as it's had more bug fixes incorporated.

So patch 1 is out now and

tgrundbacher — Fri, 16 Sep 2016 06:49:24 GMT

So patch 1 is out now and CSCva01828 seems to be fxed. But from the info provided, I still can't make a proper judgement whether it will fix the Indexing Engine problem when upgrading from ISE 1.3. Additionally, when checking in the bug's details, there's still no entry in the "known fixed releases" section. I also don't know whether I'll be able to apply the patch at all if the Indexing Engine doesn't start after the upgrade. At least, it's not possible to log into the GUI after upgrading to the 2.1 base image when hitting CSCva01828.

Cisco needs to massively improve their overall quality in their products...

You can patch from the cli

Marvin Rhoads — Fri, 16 Sep 2016 14:56:28 GMT

You can patch from the cli although if you have a distributed deployment you'll need to do it for each node.

CSCva01828 will not prevent

jrabinow — Sun, 18 Sep 2016 05:55:07 GMT

CSCva01828 will not prevent you from logging into the GUI after upgrade. CSCva01828 impacts a single service from starting and can be resolved by subsequently installing patch 1 but does not impact login from GUI

OK, but at least in our case

tgrundbacher — Mon, 19 Sep 2016 06:26:07 GMT

OK, but at least in our case (1.3 -> 2.1) we were not able to connect to the GUI anymore, and the only service that did not start was the Indexing Engine. So I guess for the next trial, we only have the possibility to try installing the patch via CLI and hope for the best (or involve TAC, of course).

There is one know issue that

jrabinow — Mon, 19 Sep 2016 06:53:26 GMT

There is one know issue that comes to mind and worth noting in case applies

CSCux68828: ISE 2.0 blank screen after GUI login

Description / workaround for this is as follows:

Occurs after upgrade if have custom RBAC roles. If have such roles should delete before upgrade

Summary of info for reference

ndemers — Tue, 11 Oct 2016 23:23:02 GMT

Summary of info for reference.

FIRST BUG – NOT ACTUALLY RESOLVED.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCux68828/?referring_site=bugquickviewredir

ISE 2.0 blank screen after GUI login

CSCux68828

Problem Description:

This bug references that its fixed in 2.1 however it is not. The release notes show as resolved as well. I ran into this upgrading from 1.3 patch 6 to 2.1 Even after applying 2.1 patch 1 still was apparent. It is related to the RBAC policies in place. You have to remove the RBAC (role based admin policy) prior to upgrade or it fails to login properly. Blank screen.

Table 9 Cisco ISE, Release 2.1, Resolved Caveats
http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/release_notes/ise21_rn.html#pgfId-688783

Caveat	Description
CSCux68828	ISE 2.0 blank screen after GUI login.

SECOND BUG – NOT CLEAR ON RESOLUTION

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva01828/?referring_site=bugquickviewredir

ISE 2.1 upgrade "ISE Indexing Engine did not start"

CSCva01828

Problem Description:

The title in the release notes is wrong. Also in the description of the bug the workaround is not visible. The workaround is to call TAC and have them fix the hosts file via root access. The release notes also indirectly reference the issue but its not clear what to do. It does not say you must contact TAC in order to resolve the issue.

Table 7 Cisco ISE Patch Version 2.1.0.474-Patch 1 Resolved Caveats
http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/release_notes/ise21_rn.html#pgfId-631740

Caveat	Description
CSCva01828	Cisco ISE Indexing Engine fails to start when upgrading from ISE 2.0/2.0.1 to 2.1.

Release notes excerpt
http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/release_notes/ise21_rn.html#pgfId-702976
Hostname Corruption in Elastic Search Configuration Files

This issue occurs when you have duplicate host entries in the /etc/hosts file and you might run in to deployment-related issues after upgrade (ISE Indexing Engine status turns to “not running”). As a workaround, remove the duplicate host entries with root, and restart Cisco ISE services.

Reverse DNS Lookup Configuration

Configure reverse DNS lookup for all Cisco ISE nodes in your distributed deployment in the DNS server(s). Otherwise, you may run into deployment-related issues after upgrade (“ISE Indexing Engine” status turns to “not running”).