topic Re: Cisco ISE 3.1 patch2 installation in Network Access Control

Cisco ISE 3.1 patch2 installation

milos_p — Mon, 25 Apr 2022 17:52:04 GMT

Hi guys,

Anyone installed patch2 for ISE 3.1?

Any issues after the patch installation?

I ran into a reddit thread stating log4j hotfix should be removed before applying patch2, but I cannot find anything in Cisco documentation regarding this.

I am currently running freshly installed Cisco ISE 3.1 with patch 1.

Thanks,

Milos

Re: Cisco ISE 3.1 patch2 installation

Marcelo Morais — Tue, 26 Apr 2022 01:54:22 GMT

Hi @milos_p ,

usually it's recommend to rollback a Hot Patch before applying a regular ISE Patch release, but please take a look at:

1st README for installing Hot Patch to fix CSCwa47133 ... no info about removing the Hot Patch before an ISE Patch update.

2nd Release Notes 3.1 P2 ... CSCwa47133 is a Resolved Caveat,.

Note 1: I installed 2.7 P7 in a 2.7 P6 with CSCwa47133 without a problem.

Note 2: I didn't install 3.1 P2 yet.

Hope this helps !!!

Re: Cisco ISE 3.1 patch2 installation

mitchell obrien — Thu, 28 Apr 2022 23:58:38 GMT

3.1 Patch 2 has been removed from the downloads (and all mention scrubbed from Release Notes), possibly due to this bug. CSCwb70401 Interesting that there's not even a note in the Release Notes to advise you of this.

Sounds like it won't affect you if it's a fresh install of 3.1 compared to an upgrade from older versions, but perhaps stick to Patch 1.

Re: Cisco ISE 3.1 patch2 installation

Marcelo Morais — Fri, 29 Apr 2022 01:38:17 GMT

Hi @mitchell obrien ,

yes, it looks like that 3.1 P1 to 3.1 P2 is not an issue for CSCwb70401 ISE 3.1 Patch 2 - Services not starting due to "Integrity check failed"

Symptom:

- Services are stuck in "not running" after installing Patch 2

- When using "application start ise" command you get this message:

"% Error: ISE Integrity Check Failed! One or more ISE program files appears to

% be tampered with. Check system log for specific error(s).

% Application failed to start"

- Issue persists after rollback of patch

Conditions:

Upgraded paths impacted:

2.7 -> 3.1 -> Patch2

2.7 -> 3.0 -> 3.1 -> Patch2

3.0 -> 3.1 -> Patch2

Patch 1 not installed on 3.1

if 3.1 was the first version installed on the box (meaning there were no upgrades) the impact is avoided.

Workaround:

N/A

Severity:

1- Catastrophic

Note: ISE 3.1 P2 was removed from the Release Notes (take a look at ISE 3.1 Release Notes).

Regards

Re: Cisco ISE 3.1 patch2 installation

milos_p — Tue, 03 May 2022 09:56:37 GMT

Thanks a lot guys for your replies!

Patience was a key here, not to jump right away and install newest patch.

Re: Cisco ISE 3.1 patch2 installation

Marcelo Morais — Tue, 03 May 2022 21:42:45 GMT

Hi @milos_p ,

ISE 3.1 P3 was released yesterday (May 2nd). Please take a look at ISE 3.1 Release Notes:

Note: to understand the issue on ISE 3.1 P2 ... please take a look at: CSCwb70401 ISE 3.1 Patch 2 - Services not starting due to "Integrity check failed".

Hope this helps !!!