Cisco ISE 3.1 Automated backup configuration issue

[aamir.aleem]

Hello Community,

I am facing an issue with scheduling automated backups on Cisco ISE 3.1.

The configuration, which is very straight forward, just returns back null, i.e. lands me back on the backup and restore page without any changes on the page.

Please see the two screenshots to see the behavior.

Deployment info:

1. Two nodes(PAN,PSN,MNT)

2. Both are VMs

Thanks

Aamir

[ahollifield]

What is your repository protocol?  If this is SFTP, did you generate the crypto keys from the ISE CLI?  What happens from the CLI of the ISE nodes if you issue a "show repository Backup-Repository"

[aamir.aleem]

Hello,

1. Its FTP

2. The repository files are accessible from ISE. Manual backups to it work without issues.

Aamir

[Charlie Moreton]

What is your patch level?

[aamir.aleem]

Hello,

There are no patches installed as of now. Its more or less a relatively new deployment.

Regards

Aamir

[ahollifield]

Please install the latest patch for ISE 3.1.  This may not fix your issue but its 100% a best practice and fixes some major security vulnerabilities.  

[Marcelo Morais · Accepted solution]

Hi @aamir.aleem ,

 please take a look at: CSCwa05936 ISE 3.0 p2 scheduled backups are not triggered.

Symptom:
Somewhere after patch 2 is installed, scheduled backups aren't generated.
Manual backups run fine, but whenever the date/time for scheduled backups comes, nothing gets generated, and no info is seen on logs. Attempting to set up a new scheduled backup doesn't work either.
Conditions:
ISE 3.0 - patch 2
schedule weekly or daily backups.

ISE 3.1 has parity with 3.0 P2, you are probably hitting this bug. An update should solve the issue.

Hope this helps !!!

[kerstin-534]

No automatic schedule works in Cisco ISE 3.1 Patch 4 or Patch 5. I wonder what's so difficult to resolve this issue.

[Marcelo Morais]

Hi @kerstin-534 ,

 Schedule Backup on 3.1 P5 should work, could you please describe your issue?

Regards

[kerstin-534]

my issue is:

Schedule backups on ISE 3.1 Patch 5 do NOT work. Nothing is done from ISE. Manual backup works. 

[ahollifield]

Any errors on the backup page?  Is NTP setup correctly on ISE?  What is the repository type?  Does "show repo [name]" from the ISE CLI Return anything?

[Marcelo Morais]

Hi @kerstin-534 ,

 in my own words ...

1. the Schedule Backup do not work for any Frequency (One Time, Daily, Weekly or Monthly)

2. you are able to Schedule a Backup, for example:

 3. during the Schedule Backup you have 0 logs from:

ise/admin# debug backup-restore backup

 4. you are able to Manually Backup ISE via the Backup Now button.

Am I correct?

Regards

[kerstin-534]

Yes, NTP is set up and date/time is correct. Repo content is visible via show repository FTP1.

"Backup now" works.

I don't have debugging yet. 

regards,

Kerstin

[kerstin-534]

I have set backup time to 5:00 pm and have done 

"psn/admin# debug backup-restore backup 7"

There happens nothing at all. Cisco ISE sleeps.
I have same backup setup/configuration with ISE 2.6P12 without problems.

[aamir.aleem]

Hello,

Just a feedback regarding the issue, upon installing patch 3(which I had done a long time back), the automatic backups worked as expected. Been running them since then.

I have not tried them on patch 4 or 5 as yet.

Aamir