topic Cisco ISE 2.3 Patch 1 in Network Access Control

Cisco ISE 2.3 Patch 1

Jay233 — Fri, 21 Feb 2020 18:51:09 GMT

All,

Running ISE 2.3 (Patch 1 ) on 8 3395's, on my PAN the memory utilisation is indicating 62%, is this anything to be concerned about?

Looking through the forums its a common issue but fixed with an upgrade? I know patch 2 is available anyone able to help validate?

Total endpoint count 60,000

CPU running 2/3%

Cheers,

Re: Cisco ISE 2.3 Patch 1

paul46 — Wed, 21 Mar 2018 22:28:19 GMT

Hi Jason,

The below is from link I pasted, it seems high CPU was resolved in 2.3 patch 1

CSCvf75225

PAN runs high CPU due to 100K limit in the Redis server.

CSCvc86247

High CPU usage caused by infinite loop threads on PSN.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/release_notes/ise23_rn.html#pgfId-807037

I have just upgraded to patch 2 and as far I remember, I didn't see any CPU related issue in patch 1. I think it won't harm to upgrade to patch 2 and monitor. You can always rollback.

Looking at your endpoint, it could be your hardware limitation. you also want to check whether your hardware requirement is met with your traffic before patch upgrade.

hope this helps.

Re: Cisco ISE 2.3 Patch 1

Jay233 — Thu, 22 Mar 2018 12:16:13 GMT

Hi Paul,

Thanks for the reply, as stated in the initial post. CPU usage is not the issue its more memory usage and why it seems to be creeping up that's of concern, I was under the impression that the PAN and SAN would be utilised in a similar manner. In my case the PAN is at 62% memory utilisation and the SAN is 20% memory utilisation.

Do you think this my be a direct result of a memory leak problem?

Cheers,

Jay

Re: Cisco ISE 2.3 Patch 1

paul46 — Fri, 23 Mar 2018 01:04:10 GMT

sorry, I was a bad reader 🙂

Can I suggest you to update the title of thread to "Cisco ISE 2.3 High Memory Utilization"

Just had a look at my ISE 2.3 (patch 2) RAM and it's 80%

I found some articles where same issue was experienced on 2.2 which was resolved after upgrading to 2.3

But it looks like the issue is back to 2.3 again. please read below

https://supportforums.cisco.com/t5/aaa-identity-and-nac/ise-2-2-high-memory/td-p/3187875

I would suggest to lodge a TAC case with cisco. I will take the same action.

Please keep posted