topic Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes. in Network Access Control

Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

FLEX.Support — Fri, 21 Feb 2020 18:58:58 GMT

My web "admin" for my ISE deployment has expired. I did some searching and found a way to reset the password via CLI. Through the command line, issued the following command, "application reset-passwd ise admin" I received a prompt for the new password and then the confirmation password prompt. After the confirmation password, I received the following error "Error! Password reset is only possible from STANDALONE or PRIMARY nodes." Now, we have a pretty simple deployment. It's a standalone deployment of 2.4 done as a virtual appliance. So the error doesn't make complete sense to me. Am I doing something wrong? How do I get the admin back to working status? Any help is much appreciated.

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

ajc — Wed, 20 Jun 2018 17:34:14 GMT

It does not make sense. Did you try to reboot the VM running ISE Primary PAN using your VMware access and try again?

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

Arne Bier — Thu, 21 Jun 2018 22:31:40 GMT

If Abraham's suggestion doesn't work, then the last resort is to boot that VM from the ISE 2.4 .iso and choose option 4 to reset the admin password (this is the password recovery option used when you're in dire straits)

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

ronei.amorim — Tue, 14 Aug 2018 18:36:49 GMT

I'm facing the same issue...

But the option 4 from recovery image it's only for CLI admin...

Welcome to Cisco Identity Services Engine - ISE 3355

To boot from hard disk press <Enter>

Available boot options:

[1] Cisco Identity Services Engine Installation (Keyboard/Monitor)

[2] Cisco Identity Services Engine Installation (Serial Console)

[3] Reset Administrator Password (Keyboard/Monitor)

[4] Reset Administrator Password (Serial Console)

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

ronei.amorim — Tue, 14 Aug 2018 18:40:11 GMT

I'm trying too...

/admin# application reset-passwd ise admin
Enter new password:
Confirm new password:

Error! Password reset is only possible from STANDALONE or PRIMARY nodes.

The node was deregistered and I need register again, but admin password expire.

I also reboot two times and nothing... I'm thinking reset ise config.
But I dont know if keeps certificates already deployed.

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

musultan — Tue, 14 Aug 2018 19:23:32 GMT

As you said it is DE-registered from current deployment, then i am expecting that it should be displayed as STANDALONE.

can you check in "show tech-support" and verify the Node role as following?

*****************************************
Displaying ISE deployment ...
*****************************************
Node Config Details

NAME            PERSONA        ROLE       ACTIVE      REPLICATION
------------------- --------------- ---------- ---------- ---------------
ISE-1      PAN,PSN        PRIMARY    NONE      Not Applicable
ISE-2        MNT         SECONDARY STANDBY      SYNC COMPLETED

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

ronei.amorim — Tue, 14 Aug 2018 19:35:21 GMT

That's my output form show tech

*****************************************
Displaying ISE deployment ...
*****************************************
Node Config Details

NAME                PERSONA         ROLE       ACTIVE     REPLICATION
------------------- --------------- ---------- ---------- ---------------
ISE01             PAN,MNT,PSN     PRIMARY    ACTIVE     Not Applicable
ISE02             PAN,MNT,PSN     SECONDARY STANDBY    SYNC COMPLETED

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

Arne Bier — Tue, 14 Aug 2018 20:21:27 GMT

So did you issue the command

application reset-passwd ise admin

from ISE01? This is the Active PAN. If ISE tells you that it's not the ACTIVE PAN then you probably need to ask the TAC.

I suggested booting from .iso to set the ISE CLI admin password (but I misread your original issue) - sorry for that. If you have the cli admin password for both nodes then no need to perform the password recovery I suggested.

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

sachin.tyagi — Thu, 29 Nov 2018 19:52:13 GMT

Looks like a bug with ISE version 2.4. I am running with same issue on version 2.4:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj14636/?rfs=iqvred

Workaround: reload the PAN and then application reset-passwd ise command will work.

Re: Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

mazhar mahadik — Thu, 14 Nov 2019 08:43:29 GMT

HI ,

Reload option worked for me, i did reload of ise from cli, & then application reset-passwd ise worked,

Thanks,