topic Re: ISE 2.7 Patch 4 Issues in Network Access Control

ISE 2.7 Patch 4 Issues

Louis Gonzales — Thu, 08 Jul 2021 19:05:13 GMT

Has anyone else installed patch 4 and experienced any issues? I noticed a couple of things one was on the Licensing page the Consumption Count column was filled with random characters and not the actual numbers for the licenses being used. Also, I noticed that all of my timezones on my nodes had been changed to UTC instead of CST6CDT with the exception of one of our pxGrid nodes.

We needed up rolling back to patch 3 and everything started breaking, starting with our PSN nodes, one pxGrid, and our secondary PAN. It's been an interesting week and I have several TAC cases open. Basically, the roll back failed on a PSN first and pretty much bricked it requiring a reimage of the appliance. I was able to remove patch 4 from the rest of the nodes manually before re-registering the reimaged PSN node but once it joined the deployment the other PSN and secondary pxGrid node went belly up. In addition, the secondary admin node is behaving oddly with the ISE Messaging Service not coming up.

Re: ISE 2.7 Patch 4 Issues

Marcelo Morais — Mon, 12 Jul 2021 00:19:27 GMT

Hi @Louis Gonzales ,

how did you upgrade to P4? Did you deregister one Node, upgrade it, then start to register the other Nodes, one by one, to the New Cluster ... or ... GUI upgrade process?

Regards.

Re: ISE 2.7 Patch 4 Issues

Alex Pfeil — Mon, 12 Jul 2021 20:05:00 GMT

@Louis Gonzales,

Do you have any update on this? You are still running patch 3? Did Cisco TAC give you an update?

Re: ISE 2.7 Patch 4 Issues

Louis Gonzales — Tue, 20 Jul 2021 12:57:39 GMT

Hi @Marcelo Morais,

I just installed patch 4 the regular way through the GUI. Administration > Maintenance > Patch Management and Install for the patches. Once patch 4 was installed I notice that the license count wasn't showing correctly and since patch 4 only address a medium-security vulnerability alert it was decided that it wasn't necessary and to roll it back. I performed the rollback process the same way as the install process through the GUI. Except for this time it was completed successfully on the PAN but failed on one of our PSNs which stopped the process. I think had to complete the rollback process via the CLI on the rest of the nodes and while working on this I also noticed that 2 out of our 9 nodes had the timezone changed to UTC from CST6CDT. From looking around I found that the timezone changes on the nodes that this will render the node unusable and require a reimage, which is what I've had to do for our environment.

Re: ISE 2.7 Patch 4 Issues

Louis Gonzales — Tue, 20 Jul 2021 13:00:54 GMT

Hi @Alex Pfeil,

No TAC was only able to tell me to reimage the nodes because on the nodes where the timezone had changed they were unusable. You could not access them via GUI, CLI, CIMC for our physical 3655's, or the VM console for our VM nodes. We are currently running patch 3 now that I have finally completed the image of all of our nodes.

Re: ISE 2.7 Patch 4 Issues

Marcelo Morais — Wed, 21 Jul 2021 16:12:20 GMT

Hi @Louis Gonzales ,

thanks for the feedback ...

Statistically, I prefer the Backup/Restore process (Upgrade/Rollback via CLI), we had less issues during the upgrade/rollback of our 20 Nodes.

Regards