Cisco ISE 3.0 spinning at login after smart license integration

[Scott.Martinsen]

Good Afternoon!

We have two ISE servers, just upgraded from 2.4 to 3.0 about a month ago. Yesterday I went through the process of registering the ISE licensing with out smart account using the token. Inside Cisco license manager I can see it formed a connection with the ISE server. During the registration on the ISE server it timed out and now I can no longer login to the GUI, it just spins. I can login to the CLI and the ISE application is running. Individuals can also still connect on the wireless network that uses ISE for authentication, so it's still servicing clients. Anyone had this happen before, or any other thoughts :)?

Thanks for the help!

-Scott

[ahollifield]

Why stop at 3.0?  3.2 is now the suggested release and 3.0 has an EOL announced.  https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-0.html

Did you install any patches on 3.0?  What does "show application status ise" show on the CLI?  Have the ISE VMs been excluded from any hypervisor snapshots or backup utilities?

[Scott.Martinsen]

Good Afternoon!

Appreciate your response. My plan is to upgrade to 3.2. I thought it might be good to get the smart licensing working on 3.0 before we did that.  Here is a snip of "show application status ise"

We don't do any snapchats or backup utilities on the VM's. Just backups using the GUI inside ISE.

Appreciate the help!

-Scott

[ahollifield]

Did you install any patches on 3.0? 

[Scott.Martinsen]

Nope, no patches installed. After registering the ISE node with smart licensing the page just hung, and can no longer login into the GUI. It just spins and eventually stops. Can login into to Web GUI of secondary node. Thanks again.

[ahollifield]

You really should install the latest patch. I can almost guarantee that is your problem. There were a couple of bugs involving the smart license transport and missing CA certificates in the base 3.0 release.

[Scott.Martinsen]

That makes sense! Could I upgrade to 3.2 instead? If so, how would you recommend getting into GUI? Restart the application service? Thanks!

[ahollifield]

Patch from the CLI.   That being said, the GUI not loading is concerning.

Yes, you should upgrade to 3.2. 

[Scott.Martinsen]

Would you patch from the CLI first to try to fix the GUI issue? Or would you bypass that and upgrade to 3.2 via the CLI? Thanks

[ahollifield]

Always patch to the latest patch release before upgrading.