topic Re: Applying a Log4j patch in a Distributed Environment in Network Access Control

Applying a Log4j patch in a Distributed Environment

Lucas Woo — Mon, 09 May 2022 04:57:05 GMT

Hello,

As a title, I run a ISE in a Distributed Environment, which are Primary and Secondary.

I applied a Log4j patch to Primary node, but I couldn`t find a specific way to do it to a Secondary one.

------------------------------------------
●Primary node
# show logging application hotpatch.log
Mon May 9 hh:mm:ss UTC 2022 => CSCwa47133_all_common_1 => CSCwa47133

●Secondary node
# show logging application hotpatch.log
% Error: No such log file.
------------------------------------------

Also, I tried to make repository in a secondary node, but I can`t find the specific area to make it.

Do I have to applying a Log4j patch in a Secondary node in the first place? or Is there any way to apply it?

Re: Applying a Log4j patch in a Distributed Environment

Mark Elsen — Mon, 09 May 2022 06:51:38 GMT

>...but I couldn`t find a specific way to do it to a Secondary one.

Why not ? The cli command sequence is just the same.

Re: Applying a Log4j patch in a Distributed Environment

Flavio Miranda — Mon, 09 May 2022 10:26:11 GMT

You may want to see this:

https://www.lookingpoint.com/blog/cisco-ise-patching

and this:

https://community.cisco.com/t5/network-access-control/ise-patch-installation-in-distributed-deployment/td-p/3504027

The patch is applied only in Primary nodes.

Re: Applying a Log4j patch in a Distributed Environment

Charlie Moreton — Mon, 09 May 2022 16:34:54 GMT

Yes, you need to apply the hotpatch on EVERY NODE in the deployment. From the CLI, enter config mode (config t) then configure the repository in which the Log4j hotpatch resides.

repository <<repository name>>

url <<repository path - for example ftp://10.0.0.1>>
user <<username>> password plain (or hash) <<password>>

Which version of ISE? ISE 3.0 Patch 5 and ISE 3.1 Patch 3 have the Log4j fix in them so installing the patch through the normal methods will effectively fix the Log4j issues on all nodes.

Re: Applying a Log4j patch in a Distributed Environment

Lucas Woo — Thu, 12 May 2022 00:48:24 GMT

@Charlie Moreton
Thank you for reply.

I could configure the repository in CLI and install Log4j patch successfully.