topic ISE 2.4 patch 14:s GUI fail after patching from patch 9. in Network Access Control

ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Fri, 20 Aug 2021 11:10:58 GMT

Hello!

Got an interesting one. A VMware.based cluster(two nodes for each type) ISE 2.4 patch 9 now also patched with 14.

The patching goes well and the ISE works except for the website. All node are in sync and updated.

The website is stuck at login screen when trying to login but if you use the wrong password the website will tell you that it is wrong.

Cli works fine. Tried to 'reload node' and also separately 'application stop ise, application start ise'.

Both ways will allow you to login at the GUI but after perhaps 5-15min the website freeze and it is no longer possible to login.

Any ideas?

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Mark Elsen — Thu, 19 Aug 2021 16:40:20 GMT

- ...> website freeze

At that point verify the status of the ISE deployment with this cli-command

                ise/admin# show application status ise

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Thu, 19 Aug 2021 17:43:16 GMT

# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID
--------------------------------------------------------------------
Database Listener                      running          18882
Database Server                        running          75 PROCESSES
Application Server                     running          2580
Profiler Database                      running          22680
ISE Indexing Engine                    running          32595
AD Connector                           running          28284
M&T Session Database                   disabled
M&T Log Collector                      disabled
M&T Log Processor                      disabled
Certificate Authority Service          disabled
EST Service                            disabled
SXP Engine Service                     disabled
Docker Daemon                          running          23593
TC-NAC Service                         disabled

Wifi Setup Helper Container            disabled
pxGrid Infrastructure Service          disabled
pxGrid Publisher Subscriber Service    disabled
pxGrid Connection Manager              disabled
pxGrid Controller                      disabled
PassiveID WMI Service                  disabled
PassiveID Syslog Service               disabled
PassiveID API Service                  disabled
PassiveID Agent Service                disabled
PassiveID Endpoint Service             disabled
PassiveID SPAN Service                 disabled
DHCP Server (dhcpd)                    disabled
DNS Server (named)                     disabled
ISE RabbitMQ Container                 running          24240

Thx for reading and responding to my post.

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Marcelo Morais — Fri, 20 Aug 2021 00:30:41 GMT

Hi @Magnus Rosenqvist ,

worth the shot to double check if your Host has Snapshot or vMotion enabled.

Note: for more information: ISE Installation Guide, 2.6. search for VMware Virtual Machine Requirements.

Hope this helps !!!

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Mark Elsen — Fri, 20 Aug 2021 07:54:35 GMT

- You may also want to look at ade.log with :

show logging system ade/ADE.log

look for anomalies, if any.

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Fri, 20 Aug 2021 09:47:23 GMT

Tried and the hosts had both off.

Did found that the VMs had far too little resources assigned so I changed that. Thanks.

It did not fixed my issue though.

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Fri, 20 Aug 2021 09:53:09 GMT

Unfortunely nothing out of the ordinary.

Also used show logging system ade/ADE.log tail during a freeze without any new logs at that time.

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Mark Elsen — Fri, 20 Aug 2021 10:15:39 GMT

>....Did found that the VMs had far too little resources assigned so I changed that.

- Did you follow-up on resource-usage afterwards ? Did any new resource-issues appear ? How is the login screen stuck , you may want to add a screenshot (e.g.). Try to fetch the login screen with wget (for instance) - what happens then ?

https://linux.die.net/man/1/wget

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Fri, 20 Aug 2021 11:23:57 GMT

Added a screenshot in the first post.

The resource-usage is so low that I do not see how that could effect anything.

As for wget. It had no problems.

wget --no-check-certificate https://domain-ise.domain.se/
--2021-08-20 13:13:27--  https://domain-ise.domain.se/
Resolving domain-ise.domain.se (domain-ise.domain.se)... 10.68.233.86
Connecting to domain-ise.domain.se (domain-ise.domain.se)|10.68.233.86|:443... connected.
WARNING: cannot verify domain-ise.domain.se's certificate, issued by ‘CN=domainRootCA 2016,DC=domain,DC=se’:
  Self-signed certificate encountered.
HTTP request sent, awaiting response... 302 Found
Location: https://domain-ise.domain.se:443/admin/ [following]
--2021-08-20 13:13:27--  https://domain-ise.domain.se/admin/
Reusing existing connection to domain-ise.domain.se:443.
HTTP request sent, awaiting response... 302 Found
Location: /admin/login.jsp [following]
--2021-08-20 13:13:27--  https://domain-ise.domain.se/admin/login.jsp
Reusing existing connection to domain-ise.domain.se:443.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html                        [ <=>                                              ]  26.46K  --.-KB/s    in 0s

2021-08-20 13:13:27 (444 MB/s) - ‘index.html’ saved [27099]

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Mark Elsen — Fri, 20 Aug 2021 16:40:24 GMT

- So that hints me, that something hangs, in the context of the login-process , is the particular admin-account (mgmt-maro) ,locally defined or defined as a 'remote admin' , served by radius or ad. In that case , you may want to check the logs of the used authenticating services for the particular administrator account (like for instance , is there an auth-attempt ? , does it fail or succeed....?)

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

hslai — Sun, 22 Aug 2021 02:26:41 GMT

See SOFTWARE ADVISORY NOTICE on CSCvy53361 for ISE 2.4 Patch 14

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Mon, 23 Aug 2021 09:09:43 GMT

GUI works again. Thanks for everyones help!

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

fcabianca — Sat, 07 May 2022 19:22:27 GMT

Hello, how did you get it fixed?
We have the same problem. Thank you.

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Marcelo Morais — Sat, 07 May 2022 23:55:17 GMT

Hi @fcabianca ,

please remember the following (take a look at ISE 2.4 Release Notes😞

Hope this helps !!!

Re: ISE 2.4 patch 14:s GUI fail after patching from patch 9.

Magnus Rosenqvist — Mon, 09 May 2022 06:03:34 GMT

I downloaded the file in hslai's link and followed the instructions in the file on how to install it.