topic Re: Error while installing patch 5 on ISE 2.2 in Network Access Control

Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Fri, 29 Dec 2017 10:25:15 GMT

Hello guys,

I had an issue when I tried to apply patch 5 on our ISE cluster in version 2.2:

This error message appears after I uploaded patch via GUI. I checked in log file, but I didn’t see anything helpful…

7 [10899]:[debug] config:network: sysconfig.c[463] [admin]: Getting Domainname...

7 [10899]:[debug] config:network: sysconfig.c[485] [admin]: Getting Gateway...

7 [10899]:[debug] config:network: sysconfig.c[530] [admin]: Getting Nameserver...

7 [10899]:[debug] user: sysconfig.c[4655] [admin]: route print return value: 0

7 [10899]:[debug] config:network: sysconfig.c[4661] [admin]: ip route output:

Does somebody already have the same issue? If so, did you find a workaround?

Thanks in advance for your help!

Re: Error while installing patch 5 on ISE 2.2

Nidhi — Fri, 29 Dec 2017 12:10:14 GMT

Its best to troubleshoot the issue with TAC. please raise a TAC case for this.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Fri, 29 Dec 2017 13:23:38 GMT

Hello Nidhi,

I already asked to open a case. Meanwhile I hoped to have an answer here from somebody who could have the same issue.

Do you know if it's a known issue?

Re: Error while installing patch 5 on ISE 2.2

ognyan.totev — Fri, 29 Dec 2017 14:27:10 GMT

Are you installing on primary administration node?

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Fri, 29 Dec 2017 14:41:59 GMT

Yes I am. I have a distributed infrastructure, so after promoting the secondary adm node as a primary, I tried again to install the patch. I had exactly the same message.

Re: Error while installing patch 5 on ISE 2.2

Craig Hyps — Fri, 29 Dec 2017 14:50:47 GMT

Check the md5 checksum/crypto hash of posted patch file to the one you have to make sure not corrupted in transfer.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Fri, 29 Dec 2017 16:24:43 GMT

The md5 sum is ok. I had the same issue with another laptop, and another patch.

Re: Error while installing patch 5 on ISE 2.2

hslai — Mon, 01 Jan 2018 09:27:28 GMT

Potentially, "/localdisk" on one of ISE nodes in the deployment is running out of space. Please SSH to and log onto the ISE admin CLI of each of ISE nodes and issue "dir" to verify the available space of this /localdisk file system.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Tue, 02 Jan 2018 11:35:13 GMT

Hello,

I checked, and there is enough space on my nodes.

Adm 1 :

Usage for disk: filesystem

10764681216 bytes total used

3779428352 bytes free

15347318784 bytes available

Adm 2:

Usage for disk: filesystem

512114688 bytes total used

14031994880 bytes free

15347318784 bytes available

Mnt :

Usage for disk: filesystem

512114688 bytes total used

14031994880 bytes free

15347318784 bytes available

PSN 1 :

Usage for disk: filesystem

9643720704 bytes total used

4900388864 bytes free

15347318784 bytes available

PSN 2:

Usage for disk: filesystem

10764681216 bytes total used

3779428352 bytes free

15347318784 bytes available

But what is strange is that I failed over the cluster few times. Finally the patch was successfully installed but only on two nodes (adm from which I launched patch installation, and the primary monitoring node).

Re: Error while installing patch 5 on ISE 2.2

hslai — Tue, 02 Jan 2018 19:54:28 GMT

If not already done, please provide the support bundles from all ISE nodes to TAC for investigation. If you do not want to wait, I would suggest to apply the patch via ISE CLI on those "not installed" ones.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Wed, 03 Jan 2018 11:03:29 GMT

Actually before I was able to install patch from GUI on two nodes, I tried to install it on my primary admin via CLI. After patch installation, ISE processus was stuck on "initializing", and I had to reimage the node (I tried cold reboot without success). I'm afraid this issue happens again and I really don't want to reimage my full cluster.

Re: Error while installing patch 5 on ISE 2.2

hslai — Wed, 03 Jan 2018 16:40:21 GMT

It's important to find out why ISE stuck in "initializing" by engaging TAC, unless you are able to share the support bundle in this public forum. Patching via CLI should work as good as via Web UI, if not better, unless some specific bug preventing it to work.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Wed, 03 Jan 2018 17:09:16 GMT

Honestly I didn't check the logs, but I guess it's because a process locked the database, so ISE application wasn't able to access the DB (I already had this issue).

The problem is that for now I just tried to patch our mockup environment (5 nodes), but our production one has 19 nodes, and I really didn't want to patch them all in CLI...

Re: Error while installing patch 5 on ISE 2.2

drivera_ — Mon, 05 Aug 2019 19:29:33 GMT

Hi jgrastilleur

Did you find any solution for this issue? I'm having a similar issue when applying patch 9 for ISE 2.4 version. It is only installed in the PAN but not replicated to the PSNs.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Mon, 12 Aug 2019 09:39:26 GMT

Hello,

I finally patched my whole cluster using CLI, and it worked

Re: Error while installing patch 5 on ISE 2.2

drivera_ — Wed, 21 Aug 2019 04:03:38 GMT

Thank you so much for your answer, Julie. We were be able to do it in that way too, but we wanted to do it by using only the GUI and not patching node by node.

Re: Error while installing patch 5 on ISE 2.2

Julie Grastilleur — Wed, 21 Aug 2019 09:02:59 GMT

Hello Diego,

Unfortunately Cisco was unable to provide us a GUI solution. As a workaround to save some time, you can use the multi exec mode of your command line software (like MobaXTerm) to launch patch install simultaneously on several nodes.