topic Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed in Network Access Control

Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Thu, 27 May 2021 02:58:14 GMT

Hello!

I've recently tried to install Cisco ISE 3.0 on a Scale HC3 cluster which is a RedHat KVM-based system but am experiencing some issues. I wanted to go through the evaluation to see if ISE could even run on this platform.

I've created the VM with 4 cores, 16GB of RAM, and a 500GB disk. The installation seems to go smoothly.

I input the IP, subnet, gateway, nameservers, domain and it pings the necessary components during install no problem.

However, when I get to the Database Priming, I am constantly getting a "Database Priming Failed!" error message. The error message even continues after an "application reset-config ise". I've also just continued with the install, but when I do so, the application server is stuck in initializing and I get a "connection refused" message while trying to access the web GUI.

I believe this might have something to do with the database priming constantly failing, but I'm not sure.

I've deleted and reinstalled the VM many times with the same issue. I've redownloaded the .ISO constantly as well.

I've asked support at Scale to see if it's even possible to install on the platform, and one of the support engineers was able to install ISE 3.0 on their cluster and access the GUI with no problem.

Is there anything, in particular, that would cause this "database priming" issue on my setup but not the support engineer who is running the same cluster?

Thank you for all of your help!

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

Mark Elsen — Thu, 27 May 2021 06:58:12 GMT

- From the cisco viewpoint it does not seem supported :

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/release_notes/b_ise_30_rn.html#concept_ADD2FA0C156341BCA7E29A18F08F9519

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/release_notes/b_ise_30_rn.html#id_64711

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Thu, 27 May 2021 12:46:09 GMT

From your link "KVM on QEMU 1.5.3-160" is listed as a supported platform. This is what the Scale HC3 platform is.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

Mark Elsen — Thu, 27 May 2021 15:48:12 GMT

- FYI : https://community.cisco.com/t5/network-access-control/error-database-priming-failed/td-p/2591712

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Thu, 27 May 2021 15:50:32 GMT

Thanks for replying Marce!

There is a correct DNS entry for the machine in our DNS.

I can do nslookups from the ISE VM and they resolve correctly using the given nameserver.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

Mark Elsen — Thu, 27 May 2021 16:21:39 GMT

- Have a look at show logging system ade/ADE.log , possibly for more info. show logging system will show a list of a log files which can be examined accordingly.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Thu, 27 May 2021 18:52:00 GMT

Thanks again Marce!

Combing through those logs I do see interesting entries about the database not being able to be logged into.

I also noticed that in the attached screenshot with "Database Priming Failed", the time wasn't set correctly even though NTP information was given prior to the database priming happening. Could that possibly be a factor? If so, how do I get the NTP to take effect before the database priming happens?

Later on, in the logs, it seems that the correct NTP information is taken as the time changes from 13:xx:xx to the correct time of 8:xx:xx, but this is AFTER the database priming takes effect and fails.

Thank you! If attaching screenshots like this isn't the best way to show pictures in this forum, please let me know!

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

Mark Elsen — Fri, 28 May 2021 07:51:23 GMT

>...If so, how do I get the NTP to take effect before the database priming happens

Difficult to comment on , I would for instance make sure that the NTP configuration is OK and working on the parent-Redhat host.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

lrojaslo — Fri, 28 May 2021 12:47:55 GMT

There is an issue currently under investigation about this behavior, that when you enter domain/subdomain with only numbers it causes database priming error.

Try using domain/subdomain with numbers and letters or only letters.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Sat, 29 May 2021 02:09:26 GMT

Are you saying during set up when it asks for DNS domain?

Or when giving nameservers? I did give only ip addresses for name servers. Should I try domain/ip?

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

lrojaslo — Mon, 31 May 2021 13:25:42 GMT

on DNS domain name.

Also make sure of the following:

* Make sure revers DNS is working fine for the hostname/FQDN of the ISE node (this should be case sensitive to avoid issues).

* When doing reset-config, choose to not keep system certs.

If you still have issues, I would advise to open a TAC case.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Tue, 01 Jun 2021 13:25:05 GMT

Thank you for the response!

Just wondering, for the DNS domain name, ours is xxx.local. Should I be inputting it a different way?

Reverse look-ups are working fine for the FQDN of the node.

I'm trying to evaluate ISE to see if it's something I want my district to purchase. TAC will not help me in this instance correct?

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

lrojaslo — Tue, 01 Jun 2021 13:39:36 GMT

domain name is fine with that format.

you should receive assistance from TAC even for evaluation.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

thomas — Tue, 01 Jun 2021 23:51:33 GMT

ISE 3.0 requires a minimum of a 3515 which is 6 cores - not 4 - so your install would be Unsupported.

See ISE Hardware Platforms for hardware minimums.

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

ferriterj1 — Wed, 02 Jun 2021 13:01:50 GMT

Hey Thomas, thanks for replying!

No luck. Created a new VM with those specs and still get the database priming failed error.

TAC also won't help, as stated above, because I don't have a service contract with ISE. So I'm in a rough spot with this evaluation of ISE so far...

Re: Cisco ISE 3.0 Redhat KVM Install - Database Priming Failed

lrojaslo — Wed, 02 Jun 2021 14:18:00 GMT

If you are able to have CLI access, try installing the latest patch, there are few defects on 3.0 unpatched with this error. Otherwise, I would consider this is related to VM compatibility.

Which RHEL version are you using for installation?