topic Re: ISE in Network Access Control

ISE

jthombs1016 — Tue, 14 Aug 2018 13:47:22 GMT

Hi All

I have a ISE virtual device is constantly crashing and is unresponsive and slow.

I am running the flowing version

Version : 2.4.0.357.

The ISE application constantly stops

ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 5012
Database Server running 96 PROCESSES
Application Server not running
Profiler Database running 6656
ISE Indexing Engine running 16856
AD Connector running 26475
M&T Session Database running 6465
M&T Log Collector running 12154
M&T Log Processor running 12060
Certificate Authority Service running 20348
EST Service running 16259
SXP Engine Service disabled
Docker Daemon running 7421
TC-NAC Service disabled
Wifi Setup Helper Container running 19847
Wifi Setup Helper Vault running 43
Wifi Setup Helper MongoDB running 16
Wifi Setup Helper Web Server running 233
Wifi Setup Helper Auth Service running 132
Wifi Setup Helper Main Service running 176
Wifi Setup Helper WLC Service running 215
pxGrid Infrastructure Service disabled
pxGrid Publisher Subscriber Service disabled
pxGrid Connection Manager disabled
pxGrid Controller disabled
PassiveID WMI Service running 28395
PassiveID Syslog Service running 22452
PassiveID API Service running 23281
PassiveID Agent Service running 24196
PassiveID Endpoint Service running 25164
PassiveID SPAN Service running 26091
DHCP Server (dhcpd) disabled
DNS Server (named) disabled
ISE RabbitMQ Container running 7746

As anybody need this before

Re: ISE

howon — Tue, 14 Aug 2018 14:06:35 GMT

If this is in production, please contact TAC. But, in general this is due to insufficient resources allocated to ISE or the resources are being shared with other guest OS on the host. Make sure to give enough CPU/RAM per installation guide and confirm that they have been reserved for ISE.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_01.html#ID-1417-00000074

Re: ISE

jthombs1016 — Tue, 14 Aug 2018 14:18:19 GMT

Thanks.
We have allocated 12 CPUs. And 128 GB of RAM.

Re: ISE

howon — Tue, 14 Aug 2018 14:27:06 GMT

Please allocate resources to match either 3515 (12 vCPU with HT, 16GB RAM) or 3595 (16 vCPU with HT, 64GB). If running 2.4 you can also allocate (16vCPU with HT, 256GB) for dedicated MnT. But more importantly, make sure the resources are dedicated to ISE.

Lastly, if VMware snapshot is being used, make sure it is turned off.

Re: ISE

paul — Tue, 14 Aug 2018 15:11:04 GMT

Allocating resources is one thing, but have you reserved all the resources. If using 12 CPUs then you should be reserving 12,000 MHz of CPU capacity and all memory should be reserved.