Here is my nightmare of refreshing my ISE environment from ISE 3.0 patch-3 to ISE 3.2 patch-4. It took over 24 hoursto complete everything on a four nodes cluster. Here is what it took to finish the job with ZERO downtime:Appliances are SNS-3655nodeA...
This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
Forum Posts
Resolved! ISE Licensing
Hi, I no longer want to evaluate licenses any more, and I want to just use the Base license for ISE, how do I go back to just using the Base license?
I'm looking for a way to renew the "Certificate Services Node CA" certificate that was signed by the internal Root CA. The Node CA is expired but was not renewed by ise. I'm able to create a csr but can't find a way to sign it, except exporting and s...
I have received this error message a few times and I'm trying to find out what it means and what to do about it. If I follow the instructions in the alert and manually run the test it always comes back as passing. I'm running 2.4.0.357 with patch 1.T...
Resolved! Cisci ISE and forescout in same network
DearsI would like to use the ISE for the tacacs and guest network and forescout for the rest of the services, can i add both of them in the switches and routers, how things will work in this case the authentication will work with ISE and the dot1x an...
Dear Community,We have 3 deployment Nodes - PAN- Secondary Node- PxGride NodeWe use switch cisco model 9200 which supporting critical vlan.In case all ISE Nodes completely down how to bypass new endpoints session and existing session still alive and ...
I am working on deploying 802.1X for endpoints (basic IP phones, Windows clients, printers) on an enterprise network using ISE w/ TrustSec in a Cisco only environment (IOS-XE switches). I have done this a few times, however the topic of configuring I...
Resolved! Patching ISE? UI or CLI?
I have a 4 nodes ISE 3.2 patch-4 cluster:node1: Primary Admin/Primary MNTnode2: Secondary Admin/Secondary MNTnode3: PSNnode4: PSNwhat is the best way to patch these nodes going forward to patch-5 and beyond? I am gettingdifferent answers from Cisco T...
Hi All,We have two Cisco ISE 3.1 running in HA using default self-signed certificate.We want to change/replace self-signed certificate with Window CA signed cert .Could you guide me how can I replace the cert ? Do I need to apply the cert in both ISE...
Is it possible to automatically delete backup files generated by scheduling in ISE after a certain date (for example, if you back up every day, only one week's worth of backup files remain)?
Resolved! Cisco ISE sizing - small or medium
Hi team, I'm trying to figure out what sizing we should establish as well as if we should go for a small or medium deployment. Currently, there are around 15.000 active endpoint in the environment, but as the company is growing very fast, it could be...
I am testing out the upgrade on a single node ISE 3.0 patch-7 to ISE 3.2 patch-2. When I run the preparation using ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542b.SPA.x86_64.tar.gz, it fails at "Configuration at Data Upgrade". To be clear, this node is...
Hi all;When we want to assign VLAN numbers to interfaces dynamically through ISE authorization profile result, one parameters should we consider is "Tag ID". Right?My question is, what is the purpose of Tag ID and when we should changes it?Thanks
Hi all;Look at the following screenshot:In the above scenario, the "Win-PC-02" is connected to an interface that belongs to VLAN 20. After authentication, proper authorization policy applied to that interface which changes the VLAN of it to 10. So, a...
Some my clients started to get error when they try to connect wifi with 802.1x. On the Ise I can see log with error (on the phone I set CA Certificate as don't validate)Event 5400 Authentication failed Failure Reason 12321 PEAP failed SSL/TLS handsha...
