topic Re: Cisco ISE Profiler update broken following upgrade to 2.1 in Network Access Control

Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Sun, 30 Oct 2016 15:08:59 GMT

Recently upgraded my lab environment from 1.4 to 2.1 and the Profiler feed updates are failing with the below error:

FeedService test connection failed : Feed Service unavailable : ConnectException invoking https://ise.cisco.com:8443/feedserver/feed/serverinfo?ISE_VERSION=2.1.0.474: Network is unreachable **Please ensure that the certificate store on ISE has a valid and enabled entry for either the root certificate or the intermediate certificate for the SSL server certificate chain of Cisco ISE feed server. **Please ensure that Proxy settings are configured if needed to reach Feed Server.

I have all required certificates in my trust store so that's not an issue. Please advise if anyone has seen this issue before.

thanks

Re: Cisco ISE Profiler update broken following upgrade to 2.1

hslai — Sun, 30 Oct 2016 15:33:20 GMT

Yes, we've reported it to the team.

Meanwhile, please try the offline-update option.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

stayd — Mon, 31 Oct 2016 09:14:18 GMT

Yes, we have the same issue. It appers 3 days ago, beginning from 29th of October and it is not just after upgrading from one previous version of ise to version 2.1. We operate version 2.1 since beggining of August.

Do you have some answers from TAC team ?

Re: Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Mon, 31 Oct 2016 10:59:28 GMT

Haven't called TAC yet as I found I was getting responses a lot quicker via this forum.

In this particular issue it seems that ISE doesn't even attempt to go out and fetch the feed updates,

I don't see any logs in my firewall since the upgrade.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

hslai — Mon, 31 Oct 2016 11:50:40 GMT

This service is working at the moment. Please check.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Tue, 01 Nov 2016 00:17:02 GMT

It's working for me now. However the way I got it to work was to promote the standby PAN node to primary. I am going to fail it back to secondary and see if it is still working.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

stayd — Tue, 01 Nov 2016 00:22:21 GMT

For me now too again. It seems like that.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Tue, 01 Nov 2016 00:28:34 GMT

For me it only started working after I promoted the secondary PAN/MnT to primary. I am going to fail it back now and re-test. The updates are happening on TCP 8443 so you need to have that allowed outbound on your firewall.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Tue, 01 Nov 2016 01:16:06 GMT

So I just failed back to my original PAN node and the profiler feed updates are failing with the original error:

I believe something must have gone wrong on that particular box following the upgrade.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

hslai — Tue, 01 Nov 2016 02:53:32 GMT

Yours is the first I heard that the ISE profiling feed failed after an upgrade to ISE 2.1. As your secondary PAN did not have this issue, it might be best for you to promote it as the primary PAN and then rebuild this problem box.

Re: Cisco ISE Profiler update broken following upgrade to 2.1

gvoden4prez — Tue, 01 Nov 2016 12:26:07 GMT

Thanks, finally fixed. It was a routing issue with the default gateway on this server:

It was using the below notation which should work fine:

ip route 0.0.0.0 0.0.0.0 gateway 10.86.224.237

however I compared to my other PAN and the default gateway command was set as:

ip default-gateway 10.86.224.237

I changed this on my main server and it's finally updating.