topic Re: ISE Restore Stuck in Network Access Control

ISE Restore Stuck

KiloBravo — Tue, 05 Oct 2021 08:23:03 GMT

I'm trying to restore a backup from another (older) server to this newer one, both servers on the same version/patch.

The restore seems to get stuck at 20% for no obvious reason. It's been there for about 3 hours now but on the first attempt it was left for days with no progress. This is being done on the CLI.

ade.log and ise-psc.log do not show anything useful.

This is 2.7 patch 4.

Any ideas would be appreciated

[REMOVED]/admin# show restore status
%% Configuration restore status
%% ----------------------------
% backup name: [REMOVED].tar.gpg
% repository: [REMOVED]
% start date: Mon Oct 4 13:45:33 UTC 2021
% scheduled: no
% triggered from: CLI
% host:
% status: Restore is in progress
% progress %: 20
% progress message: Retrieving backup file from Repository

%% Operation restore status
%% ------------------------
% No data found. Try 'show restore history' or ISE operation audit report
[REMOVED]/admin#

Re: ISE Restore Stuck

ComputerRick — Mon, 04 Oct 2021 17:47:20 GMT

First, for the repository where the backup is being retrieved from, can you do a "show repo <repo>" and see the files? It seems to be timing out while copying from the repo. I'd also check the directory structure and ensure that the file is there.

Re: ISE Restore Stuck

KiloBravo — Mon, 04 Oct 2021 20:52:49 GMT

thanks for you're reply ComputerRick. I did a show repo and all the files in the directory are showing fine, including the backupfile.

Re: ISE Restore Stuck

Marcelo Morais — Mon, 04 Oct 2021 21:32:10 GMT

Hi @KiloBravo ,

please try the restore via CLI:

ise/admin# restore CONFIG-DATA-<xxxx>.tar.gpg repository <repo name> encryption-key plain <password>

the process should look like this:

% Warning: Do not use Ctrl-C or close this terminal window until the restore completes.
Initiating restore. Please wait...
% restore in progress: Starting Restore...10% completed
% restore in progress: Retrieving backup file from Repository...20% completed
% restore in progress: Decrypting backup data...25% completed
% restore in progress: Extracting backup data...30% completed
Leaving the currently connected AD domain
Please rejoin the AD domain from the administrative GUI
% restore in progress: Stopping ISE processes required for restore...35% completed
Cleaning up TC-NAC docker configuration...
% restore in progress: Restoring ISE configuration database...40% completed
% restore in progress: Updating Database metadata...65% completed
% restore in progress: Restoring ISE Indexing Engine...70% completed
% restore in progress: Restoring logs...75% completed
Modifying the haconfig status after upgrade...
% restore in progress: Restarting ISE Services...90% completed
% restore in progress: Completing Restore...100% completed

Hope this helps !!!

Re: ISE Restore Stuck

KiloBravo — Tue, 05 Oct 2021 07:48:04 GMT

Thanks Marcelo. I'm already doing it from the CLI though. Might be worth adding also that this is a restore onto a new server rather than the same server the backup was taken on. I'll edit the original post to include that.

Re: ISE Restore Stuck

ComputerRick — Tue, 05 Oct 2021 19:32:16 GMT

First, I'll put the backup and restore directions below for ISE 2.7. I suggest you look at the caveats.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_maintain_monitor.html#ID312

What is the status of the node that you're restoring on?

Is it in standalone mode? Fully configured?

Is it a node in a deployment with other ISE nodes?

From the CLI, can you run "show disk" and make sure there's enough space for the backup?

20% is typically a failure to copy the backup to the local disk. Normally if the key is wrong, it'll tell you that, so I suspect that this is failing prior to or during the copy.