topic Re: What can cause ISE in Network Security

What can cause ISE

Leftz — Wed, 08 Dec 2021 16:40:14 GMT

Hi we have ISE 2.4 with primary and secondary PAN and several PSNs. Two MnTs are at PAN node together. When we logon the ISE via PAN, we can see each reaction is very slow. Anyone has some suggestions to resolve it? Thank you

Re: What can cause ISE

Rob Ingram — Wed, 08 Dec 2021 16:43:52 GMT

@Leftz

How many concurrent sessions do you have?

What is the specification of the ISE hardware/VM?

Potentially you may want to deploy new ISE nodes and have dedicated MnT nodes, thus taking the load of the PAN.

Re: What can cause ISE

balaji.bandi — Wed, 08 Dec 2021 16:49:30 GMT

i would suggest to re-visit the resource issue and make necessary action based on the requirement.,

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_00.html

Re: What can cause ISE

Leftz — Wed, 08 Dec 2021 17:01:31 GMT

Thank you for your reply!

How many concurrent sessions do you have?

-- concurrent session is this Active Endpoints? Its about 1000 at primary PAN. 500 at secondary PAN. Why there is different number between the two PAN?

What is the specification of the ISE hardware/VM? at VM

Re: What can cause ISE

Rob Ingram — Wed, 08 Dec 2021 17:02:21 GMT

@Leftz good question, are these ISE nodes part of a cluster? Or do you have separate clusters?

You have a small deployment, what is the VM spec of the CPU and Memory?

Does it meet the Cisco recommended requirements?

Re: What can cause ISE

balaji.bandi — Wed, 08 Dec 2021 17:08:11 GMT

Check the URL I have provided has Specification, what is the current resource you have ?

Re: What can cause ISE

Leftz — Wed, 08 Dec 2021 17:08:17 GMT

are these ISE nodes part of a cluster? Or do you have separate clusters?

These nodes mentioned above are all we have. I do not think it is part of a cluster

You have a small deployment, what is the VM spec of the CPU and Memory?

Can we get the info from the ISE? If not, now i cannot get the info as its managed by another team

Does it meet the Cisco recommended requirements? should be

Thanks

Re: What can cause ISE

balaji.bandi — Wed, 08 Dec 2021 17:19:07 GMT

what version of ISE ?( I have missed 2.4 ) - if you looking to deploy new look for 2.7 or 3.0

2.7 here is the requirement :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/InstallGuide27/b_ise_InstallationGuide27/b_ise_InstallationGuide27_chapter_01.html

Re: What can cause ISE

Rob Ingram — Wed, 08 Dec 2021 17:14:35 GMT

@Leftz run "show inventory" to determine CPU and memory are compare to the ISE guides for the deployment requirements.

Go to the configuration > deployment and determine what ISE nodes are part of the cluster.

Re: What can cause ISE

Leftz — Wed, 08 Dec 2021 20:29:15 GMT

Sorry, cannot logon ise via cli to get that info. When we logon to ise via GUI, we use three info: username, password and identity source. but via cli, how can we enter identity source?
In Gui, i cannot find info for CPU and memory via Gui. but i am sure its not in cluster.

Its version is 2.4 Thanks

Re: What can cause ISE

balaji.bandi — Wed, 08 Dec 2021 22:01:18 GMT

what account you trying to login ? Not sure if the ISE configured as Multi authentication, command level i do not see that option, you can just login using admin account ?

On the GUI Home - dashboard you see the system summary.

Re: What can cause ISE

Leftz — Wed, 08 Dec 2021 22:37:30 GMT

Tried to logon to PSN and PSN via cli, but failed. I think its because it need to enter username, password and Identity Source. we can enter the three via Gui, but cannot enter the three items via cli, instead I can only enter username and password via cli. Do not know how to enter Identity Source if using cli.

Please see the below

Re: What can cause ISE

Rob Ingram — Thu, 09 Dec 2021 08:06:07 GMT

@Leftz just because you have configured the GUI to authenticate using an external identity source, does not mean the CLI is configured the same way. All ISE nodes will have a local "admin" account which you can login to the CLI, you will need to know this password, if not you will need to speak to someone who does or reset the password - guide.

Altertnatively, just speak to the server team who adminster the VMs and ask them what CPU, memory has been provisioned for the ISE VMs.

Re: What can cause ISE

balaji.bandi — Thu, 09 Dec 2021 08:11:26 GMT

I am more interested to know what username and password you use to Login ( admin account), Looks like ISE configured external source to authenticate, But again admin account is local (so i am more interested to know the username you using to login)

Re: What can cause ISE

Leftz — Thu, 09 Dec 2021 14:20:40 GMT

Based on my understanding, the credential for gui and cli is different. and Gui cannot change/reset cli credential, it this right?

Re: What can cause ISE

Rob Ingram — Thu, 09 Dec 2021 14:32:53 GMT

@Leftz yes you are correct. The GUI and CLI have the same user account called "admin" but they are different. The GUI cannot reset the CLI admin password. If you don't know the CLI password you would need to reset it as per the information in the guide provided above.

Re: What can cause ISE

Leftz — Thu, 09 Dec 2021 15:21:20 GMT

Thank you Rob! Not sure if I should ask questions again since the post is very long

You asked how many concurrent endpoint in previous, I notice there is different concurrent endpoint number between primary and second PAN. Is this normal? How long ISE show active endpoint after the active endpoint is off line

Re: What can cause ISE

Rob Ingram — Thu, 09 Dec 2021 15:43:01 GMT

@Leftz no it is not normal, if everything was setup correctly on the NAD I think the session should expire from ISE in 15 minutes. Can you please provide a sreenshot from the Primary PAN and Secondary PAN GUI to reflect this discrepancy in the number of sessions. Provide a screenshot from the deployment page to confirm the roles/personas of the ISE nodes as well.

Re: What can cause ISE

Leftz — Thu, 09 Dec 2021 16:16:21 GMT

There are some company info on the screenshot. I am not sure if i can remove it from the screenshot. but i can try. otherwise we need to open a case for cisco. Thank you for your answering my question.

Re: What can cause ISE

Rob Ingram — Thu, 09 Dec 2021 16:25:45 GMT

@Leftz edit the screenshot by hiding some of the company specific information, send a private message if you prefer.