topic Re: ISE MAX Authorization profile in Network Access Control

ISE MAX Authorization profile

imanv — Sat, 01 Mar 2025 06:35:39 GMT

I have ISE with more than 600 authorization profiles. I know that the ISE has 3K limitation on authorization profiles, but I don't understand why authorization profiles in my deployment won't open. After trying and waiting for a 5-10 mins, the Application Server restarted on my active PAN.

My deployment information :

ISE 3.1 Patch 10

VM Configuration : 24CPU, 96G RAM, 600G Disk

I backedup and work on profiles in separate ISE in LAN with exact same VM config, but I faced same problem.

I delete more than 200 profiles but I still have same problem on my ISE in laboratory.

I'm eager to here your suggestions.

Re: ISE MAX Authorization profile

Mark Elsen — Sat, 01 Mar 2025 07:33:37 GMT

FYI : https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html
You probably need to look into https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html#toc-hId--1710967437

Probably best to open a TAC case too,

Re: ISE MAX Authorization profile

imanv — Sun, 02 Mar 2025 04:20:24 GMT

@Mark Elsen

Thanks for your reply. Actually my problem is the authorization profiles not open and If I try to open it and stay for 5-8 min, the Application Server will rebooted and access to PAN lost until the Application Server loading finish.

Re: ISE MAX Authorization profile

imanv — Sun, 02 Mar 2025 06:54:13 GMT

I check the processing in PAN when I'm trying to fetch the Authorization profiles and I found that the CPU load is going high. Here is the MAX CPU log.

Even after the loading profiles, creating a new profile also has taking a long time.

I used application configure ise command with the following items:

Rebuild M&T Unusable Indexes

Create Missing Config Indexes

Create Missing M&T Indexes

Clear Sysaux tablespace

Recreate Temp tablespace

I install a new ISE in a lab an restore the configuration backups, same problem there. Even after upgrade to 3.3, the problem still exist.

nothing changed....