topic Re: vMotion support for ISE in Network Access Control

vMotion support for ISE

chrivand — Wed, 23 May 2018 06:28:30 GMT

Hi All,

I have found that currently vMotion is stated in the config guide as being supported. Is that correct? In a previous post that was closed I could read that this was not supported yet.

http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/install_guide/b_ise_InstallationGuide21/b_ise_InstallationGuide21_chapter_010.pdf

If it is supported, what are the limitations and guidelines?

Thanks in advance!

Re: vMotion support for ISE

Craig Hyps — Wed, 23 May 2018 11:32:22 GMT

vMotion is listed as supported but we have received reports of issues with current ISE versions. ISE does not have a facility to stop/pause the db operations during vMotion and so this may lead to data corruption issues. A similar issue exists with snapshots.

We have a request in to QA to validate the current caveats / restrictions and update documentation with current status. In short, I would not recommend vMotion at this time. However, you should be able to shutdown and replicate/migrate VM without issues.

Re: vMotion support for ISE

chrivand — Wed, 23 May 2018 14:42:48 GMT

Hey!

Thank you very much for the answer. We heard of this, but when we saw it in the guide we thought that this might have changed. I will pass on the information and I look forward to the support of vMotion in the future.

Thanks again!

Re: vMotion support for ISE

Brian Taylor — Mon, 03 Dec 2018 10:10:06 GMT

@Craig Hyps any new information on vMotion recommendation with ISE2.4/2.5?

Re: vMotion support for ISE

Guillaume BARBEROT — Wed, 03 Apr 2019 13:59:26 GMT

i don't know if it answers your question, but a bug id is dealing with vMotion not supported on ISE : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn47559

Regards,
Guillaume

Re: vMotion support for ISE

Jacob Pyle — Wed, 01 May 2019 14:01:53 GMT

Looks like we just hit this bug as well.. MNT node vmotioned and now certain UI elements aren't loading. TAC case opened.. Have disabled automated vmotion for now.

Re: vMotion support for ISE

justin_leopold — Thu, 18 Jul 2019 14:24:56 GMT

Is there any road map to implement a permanent fix? Having these as VMs is really harming our ability to have a fully hands off and automated patching or upgrade cycles. This seems ridiculous for a multi-billion dollar software company...

Re: vMotion support for ISE

Damien Miller — Thu, 18 Jul 2019 20:04:22 GMT

If you are a Cisco employee you can use the internal page http://cs.co/ise-pm to discuss with the product managers. If you are a customer or a partner then you can use http://cs.co/ise-feedback to remind them of the enhancement request.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn60474

They won't discuss road maps for products on the public communities.

Re: vMotion support for ISE

todd.roberts11 — Tue, 10 Aug 2021 23:32:13 GMT

Is Cisco ever going to fix this? If so, when can we expect it to be fixed? Been a problem for years now.

Re: vMotion support for ISE

Marcelo Morais — Tue, 10 Aug 2021 23:54:02 GMT

Hi @todd.roberts11 ,

ISE SNS 3600-Series only support cold vMotion (please take a look at: ISE 3.0 - SNS 3500/3600 Series Appliances and Virtual Machine Requirements).

Note: you can open a TAC Case and ask TAC to add your case to the CSCvn60474 - Ability to perform vMotion while ISE VM is up and running .

Hope this helps !!!

Re: vMotion support for ISE

todd.roberts11 — Wed, 11 Aug 2021 00:08:43 GMT

I've read the documentation, Marcelo. What Im asking is if you ever plan on fixing the problem?

Re: vMotion support for ISE

Greg Gibbs — Wed, 11 Aug 2021 03:59:27 GMT

The bug filed is a feature enhancement. ISE uses an in-memory distributed database which that does not react well to the quiesce of the disk that occurs as part of the hot vMotion operation.

As stated earlier in this thread, roadmap is not discussed on this public forum. Please use the feedback mechanisms provided at http://cs.co/ise-feedback or contact your Cisco account team so they can request any updates from the ISE Product Managers.

Re: vMotion support for ISE

todd.roberts11 — Wed, 11 Aug 2021 05:10:42 GMT

Greg, most of us have been living with the problem for years now and have a sound technical understanding of the applications fragility. I don't see anyone on here asking for another technical write up on why it doesn't work, do you? We aren't asking you for trade secrets, we just want to know if you have the slightest intention of ever fixing an obvious and debilitating flaw with your product. Sounds a lot like no. What is the benefit of virtualizing this application if it can't use the the most critical features of the hypervisor?