topic Re: Cisco ISE Re-Image in Network Access Control

Cisco ISE Re-Image

Saeed Abd Elhalim Hamada — Thu, 09 Jan 2025 06:41:52 GMT

Hi i`m trying to Re-Image Cisco ISE Appliance

SNS-3615-K9

Ver3.3

but this error keep shown to me i try to run the image vie KVM map and also Flash

Re: Cisco ISE Re-Image

davidgfriedman — Thu, 09 Jan 2025 07:00:08 GMT

It reads as if it failed while writing/installing the boot loader (Grub?). I'd suggest you check the CIMC for IO/DIsk/Raid errors, then call Cisco TAC.

Re: Cisco ISE Re-Image

Saeed Abd Elhalim Hamada — Thu, 09 Jan 2025 07:04:11 GMT

Re: Cisco ISE Re-Image

Arne Bier — Thu, 09 Jan 2025 07:05:30 GMT

I wonder if it would have got this far if there was an issue with the ISO file?

It's worth running an MD5 checksum of the ISO file on the machine that you're mounting the ISO via the CIMC virtual KVM

Windows PC command line

certutil -hashfile Example.txt MD5

Was the SNS server booting normally before you started upgrading it?

There is no RAID on these servers - it's a single JBOD 600GB drive as far as I know. What could possibly go wrong there? lol

Re: Cisco ISE Re-Image

Arne Bier — Thu, 09 Jan 2025 07:14:08 GMT

what changed? Seems to run now

Re: Cisco ISE Re-Image

Saeed Abd Elhalim Hamada — Thu, 09 Jan 2025 07:41:48 GMT

i check the sum and not currapted , the SNS was work and after upgrade the MNT shown error and i open TAC and after 2 month with cisco TAC they told me to re-image , and when i re-image this problem apears to me

Re: Cisco ISE Re-Image

Saeed Abd Elhalim Hamada — Thu, 09 Jan 2025 08:51:12 GMT

Here main, log , storage log , program log

Re: Cisco ISE Re-Image

Arne Bier — Thu, 09 Jan 2025 20:32:43 GMT

Hardware appliances are supposed to make life easier/simpler. But when you have issues with the install, then maybe take a closer look at the CIMC screens, and look for error/diagnostic messages in the logs.

Maybe the HDD has some sector errors ? It might be quicker to engage the TAC and let them diagnose this - in the end you might need to RMA the appliance.

Did you perhaps attempt to update the BIOS/CIMC firmware since you got this appliance? The SNS is a UCS server, but ISE won't work unless you take the firmware images located in the ISE downloads page - putting any old random firmware on an SNS server can render it useless.

Re: Cisco ISE Re-Image

Saeed Abd Elhalim Hamada — Sun, 12 Jan 2025 20:00:05 GMT

Thanks for all comment , solved CIMC IP need to reach internet so ISE can download the package and install it

Re: Cisco ISE Re-Image

davidgfriedman — Mon, 13 Jan 2025 13:42:03 GMT

I don't know about everyone else, but I'm very concerned about this thread. When I install a Cisco ISE .iso or .ova, I do not want it going out to the internet to download packages. I want them all on the image. I want them all updated by patches. I do NOT want my ISE going out and potentially pulling dangerous or compromised packages from internet sources. Not even from Cisco. Can someone from Cisco chime in on why this person believes their ISE installation on approved hardware via a CIMC would make them think it is going out over the net to download and install updates or patches, by themselves, at any time, during the install process? ISE is supposed to be secure, so downloading software during any process, shouldn't be happening, in my mind. I definitely want Cisco to chime in and help this user understand what they think they saw happening.

Regards,
David

Re: Cisco ISE Re-Image

Arne Bier — Mon, 13 Jan 2025 19:50:27 GMT

I don’t work for Cisco but I can assure you that there is no point during the ISE install involving internet access. Whoever is spreading that rumour is getting confused with Microsoft Windows installations.

I have installed ISE in offline systems and that is how it’s been since day 1. Once ISE is installed It can reach out to get posture file updates and profiler feeds.

Aruba Clearpass has the ability to allow fetching of patches and upgrade code directly in the GUI. That is a very convenient but also requires a login to be setup first.

Re: Cisco ISE Re-Image

avakhrus — Fri, 26 Sep 2025 10:42:10 GMT

ISE installation requires no Internet connection. When it says "Downloading packages" - it downloads it from installation media, not from the Internet. Also, there is no IP configuration during ISE installation so no TCP/IP stack is running - no way it can reach anything on the network.

CIMC and its IP configuration is unrelated to ISE installation process. CIMC does not download any packages for ISE installation. Any of the above statements you can verify by doing packet capture on related network interface.

If you face an issue during installation process - in the most cases it is about a corrupted/incorrectly prepared installation media. If it is USB make sure you prepared it correctly. You can try ISO mount also as it is less complex process but may take more time.