topic Re: ISE 3.1, install patch 3, won't boot after (HyperV) in Network Access Control

ISE 3.1, install patch 3, won't boot after (HyperV)

DMel — Fri, 15 Jul 2022 15:41:17 GMT

I have tried to get ISE 3.1 patch 3 installed multiple ways and it has yet to work for me. We run ISE on HyperV as a VM.

When patch 3 first came out, I was running ISE 3.1patch1....it was stable and had no issues.

So the first time I attempted to get Patch 3 installed, I did it the same way I installed patch1, through the GUI. It all seemed to be a normal install, however, when the patch forced the system reboot, ISE never came back. After reboot, watching the console of the ISE VM, it has a blinking cursor for a few seconds, then shows the HYPER V splash screen. I have left it running like that for hours with no change. There is no way to get back into ISE when this happens.

The next time I attempted to install Patch 3, I did it through the CLI, again I had restored our ISE 3.1 with patch 1 installed. Same result. The CLI install went through its steps, and even said the patch was installed successfully, but again on reboot, ISE did not boot...just the HyperV splash screen.

I then read some community comments that mentioned uninstalling patch1 (log4j hot fix) before installing Patch2.

So, to test my theory, I created an entirely new ISE 3.1 VM on Hyperv....fresh install of 3.1 no patches at all. Again, I tried to install patch3 both from the GUI and again from CLI. Exact same result, after patch install and reboot, the ISE VM will not boot.

So both an ISE 3.1 with patch1, and a fresh install of ISE 3.1 without patches, fail when patch3 is installed, in the same manner no matter GUI or CLI install.

In case anyone thinks resources are at issue....16 CPU, 32GB Memory(static), HD: current running 3.1 with patch1 on 500GB drive; fresh install of 3.1 on 1TB drive, and HyperV is running on 2016 clustered

All event logs for HyperV/FailoverCluster show normal operations, like the VM starts with no issues as far as HyperV is concerned.

Re: ISE 3.1, install patch 3, won't boot after (HyperV)

ahollifield — Fri, 15 Jul 2022 16:02:08 GMT

This is a currently known issue with Hyper-V. TAC has a hotfix they can provide to solve the issue.

Re: ISE 3.1, install patch 3, won't boot after (HyperV)

DMel — Fri, 15 Jul 2022 19:24:22 GMT

Thank you for that tip. I have opened a TAC case to investigate the hotfix.

Re: ISE 3.1, install patch 3, won't boot after (HyperV)

DMel — Mon, 18 Jul 2022 12:14:51 GMT

It does not seem there is a 'hotfix' for this issue as much as there is a work around....plus TAC has said this specifically affects ISE v3.1 on HyperV when using a GEN2 VM. They suggest using a GEN1 VM when using ISE on HyperV, or not installing v3.1-Patch3 at this time and wait for Patch4.

The workaround involves mounting and booting from a RedHat Linux ISO and running a 'Rescue' operation to recover from an already failed ISE 3.1-Patch3 boot.

Re: ISE 3.1, install patch 3, won't boot after (HyperV)

DMel — Mon, 18 Jul 2022 14:13:35 GMT

The workaround from Cisco seems to have worked, and we are still on our Gen2 VM.