topic Hi there! I don't believe you in Network Access Control

Promote ISE secondary admin to primary.

lmqtechnology — Mon, 11 Mar 2019 06:47:38 GMT

How can you promote the ISE box currently hosting the secondary admin persona to primary? I need to know how to do this from the CLI as the admin password has expired and the primary ISE server has died.

Hi there! I don't believe you

nspasov — Mon, 23 May 2016 06:42:38 GMT

Hi there! I don't believe you can do the node "promotion" from CLI. This has to be done through the GUI:

Browse to the Secondary Admin Node > Administration > System > Deployment > Click on the "Promote to Primary" button

You should note though that the server will restart! Thus, you should plan this during a maintenance windows!

Now, if you are not able to access your GUI due to password expiration, you should:

Login to the CLI on affected node > issue application reset-passwd ise admin_username > then go back to the GUI and promote it to primary

I hope this helps!

Thank you for rating helpful posts!

problem is the password

lmqtechnology — Mon, 23 May 2016 14:00:31 GMT

problem is the password expired and then the primary died.. any options?

Did you try resetting the GUI

nspasov — Thu, 26 May 2016 01:41:25 GMT

Did you try resetting the GUI password via CLI? I have done this before and it worked for expired GUI passwords.

Thank you for rating helpful posts!

If the cl password is also

Marvin Rhoads — Thu, 26 May 2016 02:49:37 GMT

If the cl password is also expired then you need to perform password recovery. The procedure varies according to the platform as follows:

SNS 3300 series with DVD drive - restart server with ISE DVD (ISO image) in DVD drive and be connected via hardware console to interrupt the boot and recover password.

SNS 3400 series (UCS-based) - connect to CIMC and restart server. Mount virtual ISO image using CIMC utility and boot from it.

VM-based - restart VM and connect ISO via ESXi console.

Re: Did you try resetting the GUI

venccie777 — Tue, 23 Jan 2018 08:46:52 GMT

hello nspasov

regret to write on someone else' thread. But im facinig the same situation explained by the original poster.

The primary ISE is dead. And secondary ISE i have recovered the password and able to access the CLI.

But when i access the gui of the secondary ISE, it says password expired. But when i tried to "application reset-passwd" from secondary CLI it points to do the activity from Primary node. But primary node is down. Anyway to recover this condition or take the backup of the configuration?

This could be a case where Cisco could give the option to reset GUI password from secondary node in cases where primary is totally dead.

Any ways to get it work?

Thanks
Jay

Re: Promote ISE secondary admin to primary.

Srihdasari — Thu, 08 Feb 2018 15:17:43 GMT

Re: Did you try resetting the GUI

Srihdasari — Thu, 08 Feb 2018 15:18:55 GMT

Re: Promote ISE secondary admin to primary.

mhamburger — Wed, 14 Oct 2020 18:04:48 GMT

Did this issue ever get solved for anyone? Every proposed solution I see here did not actually read or understand the issue.

Re: Promote ISE secondary admin to primary.

RchowdhuryNCL — Wed, 13 Mar 2024 13:02:17 GMT

Agree some people are helpful others not so and not have answered the question. I have Hyper V so I can't restart it and change password via the CD rom. How does one promote secondary node to primary in CLI without Gui

Re: Promote ISE secondary admin to primary.

Greg Gibbs — Wed, 13 Mar 2024 22:01:22 GMT

The question was answered in the original response from 2016.. "Hi there! I don't believe you can do the node "promotion" from CLI. This has to be done through the GUI"

Promoting the Secondary to acting Primary is a change done in the underlying application. The CLI shell does not have access into this application functionality. The same applies to all current shipping versions of ISE.

Re: Promote ISE secondary admin to primary.

MathieuKORKOS — Thu, 26 Dec 2024 09:12:40 GMT

While there have been some answers in the past, it feels like this not-so-corner case has not been addressed.
If node 1 was primary but is now dead for some reason, ISE application password can not be reset in any way from node 2 since it sees itself as secondary.
Will Cisco consider implementing automatic failover for a 2-node deployment?