topic Re: Restarting ISE application server in Network Access Control

Restarting ISE application server

russell.sage — Wed, 23 Jun 2021 05:51:14 GMT

Other than preventing access to the administration web page what other impact does restarting the application server have?

Does it take out all web services? by that I mean users portals.

I went to disable the TLS 1.0 and TLS1.1 in security settings and got a warning that Application server would restart on all nodes.

Not a problem other than I did not call this out in the change and my customer has a very strict change policy.

Re: Restarting ISE application server

Karsten Iwen — Wed, 23 Jun 2021 06:06:00 GMT

The application server handles most of the basic functionality. While restarting, this node will be not available for a couple of minutes. It's a good test that will show that your redundancy concept is working.

Re: Restarting ISE application server

Damien Miller — Wed, 23 Jun 2021 06:06:55 GMT

I would recommend starting here in the Administration node high availability section. There is a table that indicates which services will be unavailable while the node is down. I would treat this as a node down impact.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_deployment.html#ID57

If your node also hosts other roles, then you should look at those sections too. If your PAN node also hosts the PSN role, then you will not have endpoint authentication during the application restart.

Re: Restarting ISE application server

russell.sage — Wed, 23 Jun 2021 06:13:46 GMT

Hi
Thanks for this. I had checked the 2.6 Admin guide. The Application Server process runs all 6 nodes 2*PAN+2*MnT+2*PSN. I was looking to disable Security settings following a Rapid7 scan. If I have to call out an outage that is fine I just didn't do that so had to abort the change.
What I can't seem to find is what functions other than the Admin GUI are impacted by the application server process restarting.
[cid:image001.png@01D767FF.3064E900]

Re: Restarting ISE application server

Marcelo Morais — Wed, 23 Jun 2021 12:36:39 GMT

Hi @russell.sage ,

please compare the following command:

ise/admin# show ports

before and after the:

ise/admin# application stop ise

you are able to verify a huge difference when you stop the Application Server.

Hope this helps !!!

Re: Restarting ISE application server

russell.sage — Wed, 23 Jun 2021 13:12:05 GMT

Marcelo

Thanks for that.