topic Re: Cisco ISE 3.1 patch3 installation in Network Access Control

Cisco ISE 3.1 patch3 installation

milos_p — Wed, 04 May 2022 07:30:23 GMT

Hi guys,

I have fresh Cisco ISE 3.1 installation with patch1 and hotfix ise-apply-CSCwa47133_3.1.0.518_patch1 (CSCwa47133 related to Apache Log4j2) applied as well.

It is not clear to me what's the correct procedure to install patch3 in this case.

Should I just install patch3 on top of my installation?

Should I first remove Log4j2 hotfix, and then apply patch3? I guess patch3 has already integrated hotfix for Log4j2?

Anyone applied patch3 already, run into some problems?

Thanks a lot!

Milos

Re: Cisco ISE 3.1 patch3 installation

Mark Elsen — Wed, 04 May 2022 09:45:34 GMT

- You don't need to remove the hotfix , https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47140 , mentions 3.1 patch2 as being fixed, since patches are cumulative that would then normally apply for patch 3 too. Note that if business context requires authoritative answer then contact Cisco TAC.

Re: Cisco ISE 3.1 patch3 installation

milos_p — Wed, 04 May 2022 10:09:14 GMT

Hi,

What troubles me is this:

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/release_notes/b_ise_31_RN.html#id_82860

"If you have installed a hot patch on Cisco ISE 3.1, you must roll back the hot patch before installing a patch. Otherwise, the services might not be started due to integrity check security issue. "

Re: Cisco ISE 3.1 patch3 installation

Mark Elsen — Wed, 04 May 2022 10:14:34 GMT

- If the rollback is easy execute it and go ahead with patch3 which then should have the fix installed, as stated if stronger guidance is needed, then work with TAC.

Re: Cisco ISE 3.1 patch3 installation

milos_p — Fri, 24 Jun 2022 06:48:51 GMT

Hi guys,

Just to post an update.

I first removed hotfix, as recommended in release notes.

I installed Patch3 successfully, no issues so far.

It fixed the bug with Guest sponsored portal with iOS devices getting stuck on "cancel" button (there was workaround with the script) that I was hitting before.

Regards,

Milos