topic Re: ISE PIC Updating to 3.2 in Network Access Control

ISE PIC Updating to 3.2

sysad43 — Wed, 02 Nov 2022 12:52:25 GMT

1. Im trying to update ISE PIC from 3 to 3.2 to see if it includes fix for below issue, but all I can download is the ISO. The update instructions say I need a patch gzip file. So how do I update?

2. Has the issue with WMI connecting to AD been fixed? On 3.0 I still get "The server-side authentication level policy does not allow the user X from address Y to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application."

A previous thread a year ago mentioned Cisco needing to fix this to be compatible with a Windows patch.

Re: ISE PIC Updating to 3.2

ahollifield — Wed, 02 Nov 2022 13:38:26 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/pic_install_upgrade/b_pic_install_upgrade_32/pic_upgrade.html
This sounds like a user permissions issue to me.

Re: ISE PIC Updating to 3.2

sysad43 — Wed, 02 Nov 2022 13:51:27 GMT

2. Its not

Solved: ISE-PIC WMI failing on Windows Server 2019 with KB5005568 - Cisco Community

1. Thanks, the release notes pointed to admin guide, which didnt have "install a patch".

Re: ISE PIC Updating to 3.2

sysad43 — Wed, 02 Nov 2022 14:00:27 GMT

Actually the guide doesnt really help either. Theres no upgrade bundle to download for 3.2, just the full ISO.

Software Download - Cisco Systems

Re: ISE PIC Updating to 3.2

ahollifield — Wed, 02 Nov 2022 14:12:28 GMT

"You must use the Cisco ISE upgrade bundle to upgrade Cisco ISE-PIC. You can download the upgrade bundle from Cisco.com."

ISE-PIC is just ISE with a license level restriction. So you use the "normal" ISE upgrade bundle to upgrade ISE-PIC.

Re: ISE PIC Updating to 3.2

sysad43 — Wed, 02 Nov 2022 14:19:28 GMT

My bad, reading comprehension.

Re: ISE PIC Updating to 3.2

sysad43 — Thu, 03 Nov 2022 18:08:24 GMT

Ok, I was able to update to 3.2, the problem with RPC still exists. Due to MS hardening DCOM, ise pic is unable to use WMI or Agent to get passive identity. Ill wait for the next patch.