topic Re: ISE 3.4 Patch 3 in Network Access Control

ISE 3.4 Patch 3

renzanjo-caparas — Thu, 14 Aug 2025 05:31:59 GMT

Hi everyone!

Good day and greetings!

Does anyone here upgraded your ISE devices to 3.4 Patch 3? Did you guys encountered any issues and bugs?

Regards

Re: ISE 3.4 Patch 3

Torbjørn — Thu, 14 Aug 2025 07:33:52 GMT

The upgrade went smoothly for my lab deployment and I have not encountered any new bugs. If your production deployment already is on 3.4 I would probably upgrade, otherwise I would wait for it to become recommended.

Re: ISE 3.4 Patch 3

Arne Bier — Thu, 14 Aug 2025 20:10:38 GMT

I'm in the same situation as @Torbjørn - I patch my lab to see the outcome but I have not been testing a lot lately. Seems ok, apart from the lack of ansible support in ISE 3.4 - but that's an issue for people who use ansible to manage their ISE environments - I hope I am wrong, but it seems Cisco BU has abandoned the ansible ise collection, and it will be dropped from the next ansible release (v12). Really unfortunate, because I was just starting to make some inroads with this stuff.

Re: ISE 3.4 Patch 3

Torbjørn — Fri, 15 Aug 2025 06:07:38 GMT

It does seem that you're right. There hasn't been any updates to the git repo since January and I found the following PR under ansible community: https://github.com/ansible-community/ansible-build-data/pull/560. That's a real problem...

Re: ISE 3.4 Patch 3

PSM — Fri, 15 Aug 2025 06:54:17 GMT

Hello Everyone, Ansible collection support is not a big issue. You can still use REST APIs of ISE in Ansible. This is the way we have been using it and it is not dependent on anyone to maintain ISE collection in Ansible. Rest someone from Cisco Devnet can comment if there is any plan to resume maintenance on collection.

Re: ISE 3.4 Patch 3

Arne Bier — Fri, 15 Aug 2025 20:38:53 GMT

@PSM - the value of a tool such as ansible, lies in creation and usage of modules - popularised in the Linux world and then found its way into other parts of IT. Cisco started out with the ise collection and the 445 modules they provide make life easier for someone wanting to automate their ISE deployment - that's the whole point of this, isn't it? . Anyone can run a curl, postman, python REST API call to ISE - I don't feel like using ansible to craft my own API calls to ISE.

I wasn't trying to say that we should not upgrade to ISE 3.4 because of this ansible saga - I just wished someone from the BU would respond and tell us what's going on.

Re: ISE 3.4 Patch 3

PSM — Sat, 16 Aug 2025 11:47:01 GMT

@Arne Bier agree with you "the value of a tool such as ansible, lies in creation and usage of modules". Most of the automation which we use ansible is against NAD devices and then related tasks against ISE. For us it has been working quit ok. But off course modules are nicer and efficient.

Re: ISE 3.4 Patch 3

M.G. — Tue, 07 Oct 2025 04:39:37 GMT

Hi everyone!

Having issue with upgrading from 3.4 patch2 to 3.4 patch 3.

problem Summary:

Two-node deployment
Upgrade via GUI – Upgrade & Rollback method.
Secondary node was not deregistered before upgrade.
Prerequisite checks passed, but upgrade failed.
CLI shows Patch 2 on both nodes, but
GUI says “Patch Install/Rollback in progress on nodes with new patch framework…”
No clear upgrade report available.

Any suggestion?

Re: ISE 3.4 Patch 3

Arne Bier — Tue, 07 Oct 2025 05:14:51 GMT

Applying a patch is not the same as upgrading. You're talking about applying patch 3 on your patch 2 deployment. There will be no node de-registrations.

I upgraded 3.3p7 to 3.4p3 recently and the upgrade was smooth - but after promoting the SPAN to PPAN, and both PANs were online again, all my nodes were shown as out of sync. I had to manually sync all of them - that's not what I had expected should happen after a promotion. And there is also a CRL download failure since the upgrade, and some object sync failures from time to time - the platform is working well - but I have a TAC case open to investigate the CRL and sync Alarms.

Re: ISE 3.4 Patch 3

Marcelo Morais — Tue, 07 Oct 2025 19:08:07 GMT

Hi,

I'd like to give "my 2 cents" to the original question: "Did you guys encountered any issues and bugs ?"

The upgrade from ISE 3.3 P7 to ISE 3.4 P3 was smooth, but ISE 3.4 P3 failed to "understand" SNS 38xx, and not only in CLI but also in GUI it shows as SNS 37xx.

A TAC has been opened and ISE 3.4 P4 will probably solve this issue.

Hope this helps !

Re: ISE 3.4 Patch 3

Marcelo Morais — Tue, 07 Oct 2025 19:07:45 GMT

Hi @Arne Bier ,

about "CRL Download Failure" ... this interests me ... : )

you are talking about the "Alarm: CRL Retrieval Failed" with the description "Could not download Certificate Revocation List for certificate with ... " ?

If the answer is Yes:

at Administration > System > Settings > Proxy ... are you bypassing the Proxy for the CRL Download ?
at Operations > Reports > Reports > Audit > Operations Audit > Object Type = CRL ... what is the Event description ?

Best regards !

Re: ISE 3.4 Patch 3

Arne Bier — Tue, 07 Oct 2025 20:28:10 GMT

Hi @Marcelo Morais

Thanks for the comment - Yes I have been bypassing the CA's FQDN in the ISE Proxy Settings for a long time. The CA's FQDN is still in the ISE Proxy config.

The Event Description is "Failed performing HTTP GET with error: (28) Timeout was reached"

I tried to capture one of these in a tcpdump and I saw no traffic on port 80.

I think you're onto something - a bug that is causing the CRL download to go via the proxy (hence, why I can't see it in the tcpdump). I will toggle this and see if I can re-program the settings.

Re: ISE 3.4 Patch 3

Marcelo Morais — Tue, 07 Oct 2025 21:25:03 GMT

Hi @Arne Bier ,

yes, I'm having "a hard time" understanding what's causing some CRL Download issues.

Note: I have the same issue when capturing a tcpdump.

Re: ISE 3.4 Patch 3

Shibble1991 — Wed, 03 Dec 2025 10:30:22 GMT

It's because of CSCwr05052. Even when you configure a bypass for the specific CA within the proxy settings, Cisco ISE still tries to download the CRL file via the proxy. If you do a tcpdump on port tcp/8080 (or whatever proxy port you are using). You will see HTTP GET to the CRL link via the proxy.

I just upgraded to patch 4 and unfortunately the same bug is still present.

Re: ISE 3.4 Patch 3

Marcelo Morais — Wed, 03 Dec 2025 13:19:46 GMT

@Shibble1991 ,

yes, the CSCwr05052 Proxy bypass is not working for CRL retrieval in 3.4 patch 2 and patch 3 could be the cause.

Unfortunately the Status is Fixed without a Known Fixed Release.

Note: I'm having this issue on ISE 3.3 P7, ISE 3.4 P3, and ISE 3.5.

Re: ISE 3.4 Patch 3

Marcelo Morais — Wed, 03 Dec 2025 13:26:25 GMT

@renzanjo-caparas ,

updating this Post ...

Please take a look at: Cisco ISE related Vulnerability (CVE-2025-20343) a CVE of CVSS high, fixed on ISE 3.4 P4.

Note: for more CVEs or Field Notice info

ISE - CVE: Year 2024 & 2025

ISE - Field Notice: Ano 2025

Hope this helps !

Re: ISE 3.4 Patch 3

mhoer — Fri, 05 Dec 2025 16:31:07 GMT

Got our 3815 appliance in almost 2 weeks ago. Came with 3.3 installed, so went ahead and set an IP address and got it online. Installed 3.3 Patch 8 and then upgraded to 3.4 Patch 3.

Could not perform a config backup after the upgrade. Apparently there is no info for the 3815 appliance in the platform properties and so it isn't being properly profiled as a 3815 appliance. So memory allocations are lower than they should be. However it does report back as a 3815 appliance.

Have a TAC case open and they are looking into it.....

Re: ISE 3.4 Patch 3

Marcelo Morais — Fri, 05 Dec 2025 18:12:23 GMT

@mhoer ,

interesting ... please take a look at: ISE - What we need to know about SNS / VM, please pay special attention to: Cisco ISE Compatibility and Checking SNS Model.

Note: please keep us posted about your TAC !

Re: ISE 3.4 Patch 3

renzanjo-caparas — Tue, 23 Dec 2025 04:55:11 GMT

Hi @Marcelo Morais ,

Good day and greetings! I really appreciate your efforts Thank you very much! I will look into this vulnerability.

Regards,
Renz

Re: ISE 3.4 Patch 3

Marcelo Morais — Tue, 23 Dec 2025 12:36:41 GMT

@renzanjo-caparas ,

thanks, please keep us posted about this !

Regards