topic Ise application initialization in Network Access Control

Ise application initialization

Ambuj M — Tue, 01 Nov 2022 02:06:10 GMT

We are noticing that during high authentication volume hours ise application crashes and application status goes to initialization state, after sometime maybe an hour it recovers on his own and goes back to running state. Wondering if somebody else is experiencing similar issue with ise 3.1 patch 3. During this time obviously all authentication fails. Upgraded to patch 4 waiting to see any improvement.

It’s a 12 node deployment with independent pan and MNT and 8 PSNs.

Re: Ise application initialization

Mark Elsen — Tue, 01 Nov 2022 07:31:20 GMT

- Do you have virtual ISE's or appliances ? For VM's follow-up on performance with the hypervisor monitoring tools, if needed increase resources such as CPU and mem , or other.

Re: Ise application initialization

ahollifield — Tue, 01 Nov 2022 08:58:15 GMT

Are you within the scale limits listed here? https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Re: Ise application initialization

Ambuj M — Tue, 01 Nov 2022 13:36:45 GMT

VM, scale supports 40k per psn with current resource reservation, I think it’s a bug, Cisco TAC couldn’t figure out, we are trying to escalate to BU at this point.

Re: Ise application initialization

Ambuj M — Tue, 01 Nov 2022 13:38:17 GMT

Yes we are

Re: Ise application initialization

Mark Elsen — Tue, 01 Nov 2022 14:32:24 GMT

- You may try to show logging system ade/ADE.log ,use this particular command when high authentication volume occurs at regular intervals (if time permits - check for related info's)

Re: Ise application initialization

Greg Gibbs — Wed, 02 Nov 2022 21:16:04 GMT

You might see if the conditions for this bug are relevant. This is the only condition under which I've seen instability so far in ISE 3.1.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd41773

Re: Ise application initialization

Ambuj M — Wed, 23 Nov 2022 21:19:50 GMT

just to let everyone know the issue was with cpu resource reservation, at the end of the day this was nothing more than miss communication between network and server team, the reservation was set to 14000 along with limit.

reservation was changed to 16000 and checked cpu limit to unlimited the issue was resolved. In addition we also made some additional changes on ise and meraki.

disable Endpoint Owner Directory and Profiler Forwarder Persistence Queue and change meraki interim update to every 3 hours compare to every 10 minutes (default).

thanks for your inputs.