topic Re: Cisco ISE IP Access in Network Access Control

Cisco ISE IP Access

Junyx sen — Mon, 11 Mar 2019 07:51:40 GMT

Hi, Guys

I have accidentally lockout our cisco ISE, I think added wrongly the IP address int the "IP ACCESS" field in the ISE.

"IP Access" list in the Administration > Admin Access > Settings > Access page.

Now I am not able to login via web or CLI. But our ISE is running on a VM so I can still console in.

Now I tried the command "application start safe" but its not working.

Anyone have encounter this issue who can share their knowledge and experience?

Thanks all.

DMel — Tue, 23 Mar 2021 20:35:54 GMT

Did you ever fix this? I see no one replied (posted 2017, I am replying in 2021).

Marcelo Morais — Tue, 23 Mar 2021 21:54:28 GMT

if you have a valid backup, please try to:

application reset-config ise
restore <backup> repository <repository> encryption-key plain <key>

Hope this helps !!!

Greg Gibbs — Tue, 23 Mar 2021 22:56:08 GMT

Starting the application in safe mode (application start ise safe) should negate the IP Access restrictions until the services are stopped again.

Did you stop the ise services before starting in safe mode (application stop ise)?

Does the Application Server show a Running state (show app status ise)?

If the answers to both questions are Yes and it's still not allowing GUI access, I would suggest calling TAC to investigate further.

DMel — Wed, 24 Mar 2021 12:12:18 GMT

Yes, this actually was the fix for me.

I found another article in the community that mentioned these steps.

Thanks for the reply!