topic Re: ISE 2.2 Endpoint Purge Bug in Network Access Control

ISE 2.2 Endpoint Purge Bug

Marvin Rhoads — Tue, 21 Feb 2017 10:43:51 GMT

FYI I had a colleague come across this new bug specific to ISE 2.2:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd01079

It's not listed in the Release Notes open caveats as of the 31 January posting date.

The symptom is the Endpoint Purge setings page tells the end user they are not licensed for configuring the feature. Of couse this is a Base feature and the admin users should certainly be able to configure it.

The workaround is "install Plus license". A bit hard to do when the customer only has Base licenses.

I do hate it when a Bug is marked "fixed" and the work around is not feasible for most customers and there's no released patch addressing it.

</end rant>

Re: ISE 2.2 Endpoint Purge Bug

hslai — Wed, 22 Feb 2017 17:15:51 GMT

Thanks for the feedback.

If your customer running into this bug, please open a TAC case as TAC may issue a temporary PLUS license to cover until the patch becomes available.

Re: ISE 2.2 Endpoint Purge Bug

Marvin Rhoads — Thu, 23 Feb 2017 02:58:51 GMT

Thanks - TAC reports it will be fixed in 2.2 Patch 1. Meanwhile the customer's account SE was able to get them a 90 day Plus license.

Is there any projection on the release date for Patch 1?

Re: ISE 2.2 Endpoint Purge Bug

howon — Thu, 23 Feb 2017 09:07:57 GMT

I apologize, but patch release dates could shift and we do not share it in the public forums.

Re: ISE 2.2 Endpoint Purge Bug

thomas — Tue, 28 Feb 2017 17:39:08 GMT

Marvin,

We try not to comment on patch releases dates and contents - it's too hard to manage expectations.

Too often customers treat a given date or anticipated bug list as a contract and get upset if things change.

It's best to work through TAC and the ISE Escalation team for your bug since that is how these fixes are typically prioritized in patches.

Re: ISE 2.2 Endpoint Purge Bug

Arne Bier — Tue, 11 Jul 2017 02:37:15 GMT

I have IE 2.2 patch 1 and I am still facing the same issue as explained in this discussion.

The bug ID mentions it's fixed in 2.2(0.901) - how does patch 1 relate to the 0.901 numbering? Is this actually fixed in patch 1?

I only have base license installed.

cheers

Re: ISE 2.2 Endpoint Purge Bug

thomas — Mon, 17 Jul 2017 19:21:10 GMT

From the Release Notes for Cisco Identity Services Engine, Release 2.2 - Cisco you will see a section for bug fixes in Patch #1 @ Resolved Issues in Cisco ISE Version 2.2.0.470—Cumulative Patch 1 :

CSCvd01079 Endpoint Purge doesn't work with Base License on ISE 2.2.

Our engineering team's release numbering scheme uses 9xx builds for noting the patch releases.

901 = Patch 1

902 = Patch 2

...

Re: ISE 2.2 Endpoint Purge Bug

slevesqu — Thu, 07 Dec 2017 16:49:27 GMT

Adding to this thread.

I see conflicting information on this behavior and customers reporting it:

- On one side there is the bug referenced above that should be fixed in 2.2P1 but is not fixed.

- On the other side, I see information that PLUS licenses are required to use endpoint purge since this feature is tied to profiling.

Which one is the right answer?

Thanks

Re: ISE 2.2 Endpoint Purge Bug

hslai — Thu, 07 Dec 2017 17:42:53 GMT

The bug is resolved in ISE 2.2 Patch 1. Please provide the TAC case number so we may follow up.

Re: ISE 2.2 Endpoint Purge Bug

Arne Bier — Thu, 07 Dec 2017 21:59:50 GMT

I will retract my comment on 11 July where I said the Endpoint purge didn't work. It did work. Purging works just fine and you don't need a Plus license.

I wasn't thinking right, and didn't realise that GREATERTHAN 1 actually means 2,3,4, ... so I was expecting the Endpoint to be deleted after 1 day (because my brain confused after with greater than)

Anyway. There are other issues with Endpoint Purge that I won't go into right now. I have a TAC case open that is looking at the Alarms details page relating to Endpoint Purge. That is definitely still broken even in ISE 2.3 patch 1. No bug yet.

I have another TAC case relating to Endpoint, because ISE is unable to run an automated Purge where the Endpoint Identity Group is NULL/Empty. CSCvg46494 - Fix in 2.4 apparently.

Re: ISE 2.2 Endpoint Purge Bug

hslai — Fri, 08 Dec 2017 17:27:24 GMT

CSCvg46494 has not been addressed in any ISE release yet but we do expect its fix will go to 2.4 first.

Re: ISE 2.2 Endpoint Purge Bug

Arne Bier — Mon, 12 Mar 2018 01:29:27 GMT

Hello

Is CSCvg46494 going to make it into ISE 2.4 ?

thanks

Arne

Re: ISE 2.2 Endpoint Purge Bug

hslai — Mon, 12 Mar 2018 01:42:41 GMT

Besides addressed in ISE 2.2 Patch 6, the last ISE 2.4 beta drop should have the fix as well.

Re: ISE 2.2 Endpoint Purge Bug

Arne Bier — Mon, 12 Mar 2018 02:52:06 GMT

What about ISE 2.3? I am currently on ISE 2.3 patch 2 and I raised my TAC case when I was on ISE 2.2 at the time. But that does not mean that ISE 2.3 should NOT have this fix.

If a bug is discovered in ISE 2.0, for a feature that has been in existence since 2.0, then (in my opinion) the fix should be integrated into 2.0, 2.1, 2.2, 2.3 and any other 2.x release.

Re: ISE 2.2 Endpoint Purge Bug

hslai — Mon, 12 Mar 2018 03:52:02 GMT

If you needing it soon, please ask TAC to request a hot patch for ISE 2.3. Otherwise, we need to wait for patch parity with ISE 2.2 Patch 6.

Re: ISE 2.2 Endpoint Purge Bug

Arne Bier — Mon, 12 Mar 2018 05:54:59 GMT

Thanks, but It's probably not urgent enough to warrant a hot patch in my case. Considering that I would be incurring downtime applying this hot patch, I would rather keep those types of patches for special occasions only.

Do I need to request that this bug is integrated into ISE 2.3 via my Cisco Sales team? Or is this done automagically within the Cisco organisation?

Re: ISE 2.2 Endpoint Purge Bug

Jason Kunst — Mon, 12 Mar 2018 06:16:50 GMT

It will be done automatically

Re: ISE 2.2 Endpoint Purge Bug

Alex Pfeil — Fri, 06 Apr 2018 13:58:35 GMT

I am seeing a purge issue as well. I am going to verify if any new updates have been released for ISE 2.3. I was counting on the purge process to automatically remove some devices that have not logged in for a specific period of time.

Thanks,

Alex