topic Re: Cisco ISE and CIMC compatibility in Network Access Control

Cisco ISE and CIMC compatibility

LuigiDiFronzo9542 — Wed, 28 May 2025 22:51:41 GMT

Hello,

An upgrade is being planned for a two-node deployment of Cisco ISE version 3.1 to version 3.3. These are SNS-3615 appliances. I have a question about the CIMC in the process.

The CIMC currently has BIOS version C220M5.4.1.3i.0_ISE; Firmware version 4.1(3b). Where can I check for compatibility? Is this version of CIMC compatible with the new version of ISE, or do I need to upgrade the CIMC firmware?

Thanks.

Re: Cisco ISE and CIMC compatibility

Arne Bier — Thu, 29 May 2025 06:51:31 GMT

The only Firmware that will work on a Cisco SNS-36X5 server is listed on this ISE Software Download Page - don't try use generic UCS firmware - it will block the boot loader because ISE boot loader is signed to boot only on special BIOS images.

The HUU (Host Update Utility) includes CIMC update, BIOS update and any other adapter firmware.

ISE 3.3 can run on a SNS-36xx server - so the latest ISE SNS-36 firmware will be supported.

Re: Cisco ISE and CIMC compatibility

LuigiDiFronzo9542 — Thu, 29 May 2025 11:59:06 GMT

Thank you for your response,

I've seen the compatibility of ISE 3.3 with the SNS-36xx server, but I'm still not sure if a CIMC firmware upgrade is mandatory.

Is there a compatibility matrix that shows a direct relationship between Cisco ISE 3.3 and the CIMC firmware version? In other words, is ISE 3.3 compatible with CIMC firmware 4.1(3b), or do I need to upgrade to which version?

Many thanks.

Re: Cisco ISE and CIMC compatibility

Scott Fella — Thu, 29 May 2025 13:49:29 GMT

@LuigiDiFronzo9542 The CIMC is just related to the server itself. You do not need to upgrade if you don't want, its not mandatory but check the release notes for bug fixes. I personally have had to due to some issues that caused memory issues. I have upgraded our 3655 appliances CIMC maybe once a year for the last two years. I have also done this for the controllers and other UCS servers. It does take a long time for it to complete, so keep that in mind if you plan on doing it. I will be upgrading our ISE deployment later this year and in the process of upgrading the CIMC once again.

Re: Cisco ISE and CIMC compatibility

LuigiDiFronzo9542 — Thu, 29 May 2025 14:32:34 GMT

Great,

Thank you so much for the explanation.

Re: Cisco ISE and CIMC compatibility

ahollifield — Thu, 29 May 2025 15:35:51 GMT

I would upgrade to the latest available as part of the upgrade personally.

Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/secure-network-server-3615-3655-3695-eol.html

Re: Cisco ISE and CIMC compatibility

LuigiDiFronzo9542 — Thu, 29 May 2025 20:08:41 GMT

Thanks ahollifield,

In that case the firmware upgrade of CIMC could be done in differents time windows, right?

Re: Cisco ISE and CIMC compatibility

Arne Bier — Thu, 29 May 2025 20:17:54 GMT

Required - no. Mandatory - no. Cisco will tell you if an SNS firmware update is mandatory. But for the most part, people only upgrade the firmware if they spot an error or Cisco tells them to - or they get spooked by the CVEs in the Release Notes.

The SNS updates mostly get published because of CVE and then if your Cyber Team get hold of that news they might force you to upgrade. But you will also benefit from all the other BIOS/CIMC fixes that are bundled in there. I would schedule it in every now and then. It takes around 30-45 min per server. I had to upgrade a bunch of DNAC Gen2 servers the other day. Customer hadn't touched the firmware in 4 years. I reckon they run a bit smoother now and it wasn't such a big deal.

Re: Cisco ISE and CIMC compatibility

ahollifield — Thu, 29 May 2025 20:21:08 GMT

Yes

Re: Cisco ISE and CIMC compatibility

LuigiDiFronzo9542 — Thu, 29 May 2025 20:36:02 GMT

Thanks.

One last thing, but now with the Cisco ISE operating system. According to Cisco documentation, Cisco ISE 3.1 is based on RHEL 8.2; however, Cisco ISE 3.3 is based on RHEL 8.4. When migrating from 3.1 to 3.3, is there anything you need to take into account regarding RHEL, or is it also updated automatically?

Re: Cisco ISE and CIMC compatibility

Arne Bier — Thu, 29 May 2025 20:42:11 GMT

It's done automatically as part of the ISE upgrade.