topic Re: ISE Alarm Disable Not Working in Network Access Control

ISE Alarm Disable Not Working

paul — Mon, 16 Oct 2017 15:20:59 GMT

I have probably ten 2.3 deployments going right now and in two of them for some reason when we disable alarms ISE continues to send out the alarms. They show up on the home screen and get emailed out. I have tried multiple times enabling/disabling the alarms to no avail. Everything looks sync'd in the deployment.

Is this a known issue in 2.3?

On the one customer, the alarms they had disabled in 2.1 are working just fine. We did a restore from 2.1 to 2.3. We disabled a few alarms after we were at 2.3 and those ones are still sending out alerts.

Re: ISE Alarm Disable Not Working

hslai — Mon, 16 Oct 2017 18:06:06 GMT

This is new to me. Please work Cisco TAC to troubleshoot.

If none of the "disabled" alarms fired on the primary ISE, then likely something to do with replications.

Re: ISE Alarm Disable Not Working

jvujcich — Thu, 19 Jan 2023 00:47:22 GMT

Fast forward to 2023 and the problem still exists.

I am on version 3.1 patch 4

I created a new email alarm, for configuration changes to the OUI, It works okay but now i cannot disable it.

Re: ISE Alarm Disable Not Working

Arne Bier — Thu, 09 Feb 2023 22:27:51 GMT

I am also on ISE 3.1 patch 4 and I can't send a single Alarm email. It worked for a day and then stopped. I have done TCPdump on the PAN and I can see successful SMTP to the Outlook server when I used the Test function. But I see nothing when I generate an alarm. I toggled the SMTP off and on again. I rebooted PAN. That didn't fix it.

I can't use patch 5 because that has a catastrophic bug in it that prevents Cisco phones from doing EAP-TLS (some openssl issue). Had to roll back to patch 4.

Re: ISE Alarm Disable Not Working

jvujcich — Mon, 03 Apr 2023 20:25:41 GMT

I resolved the issue a few nights ago (Unable to disable an alarm/email alert).

Unfortunately, I did two actions so I'm not sure which one fixed it.

1. Went from patch 3.1p4 to 3.1p5 (Lucky we don't use Cisco Phones)

2. Performed a manual syncup to the secondary MnT node.

- Go to Administration > System > Deployment > choose [Secondary MNT Node name] > click on Syncup.