Cisco ISO VM PID and Serial Number Unsupported - Plaform VM HCI

[Agung1007]

Hi team,

Kindly need your input for the issue i'm Having.

Recently our customer Deployed Cisco ISE VM 3.1 (Platform VM - Sangfor HCI)

We are using .ova for this deployment :

after we initial setup (IP Address, hostname, etc),

the ISE is Running and OK

But when I try to see the serial number (correlated for Smart License)

there's mention "UNSUPPORTED" for PID & SERIAL NUMBER:

From what i see on from this link community Link,
it caused by "wrong version" of VM for HCI Environment (it shouldn't install the .ova version) :
https://community.cisco.com/t5/network-access-control/ise-2-7-license-pid-and-sn-unsupported/td-p/4293335

Then we try to "restart" the process and continue, to install the .iso version:

but unfortunately it shows this notification (ERROR):

My question is :
- what causing the error of installation of VM ISE 3.1 iso version above?
- why when we try to install .ova, it success but for Cisco UDI/Serial Number, it mention UNSUPPORTED ?

Much Appreciated.
Regards.

[ahollifield]

Sangfor HCI is not a supported hypervisor.

[Agung1007]

Hi !

Thanks for reply.

I thought the Cisco ISE VM iso is support on Linux KVM?

*From what I Understand, and experience, the hypervisor of Sangfor HCI is Linux KVM (in another customer i deployed FMCv on Sangfor HCI , it also used on file that support Linux KVM) , CMIIW

[ahollifield]

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/compatibility_doc/b_ise_sdt_33.html#concept_ADD2FA0C156341BCA7E29A18F08F9519

[ahollifield]

While it may be based on KVM. It’s not officially supported. FMCv and ISE use completely different underlying OS.

[Agung1007]

Hi @ahollifield

Ok got it.

Thanks for your reply and explanation.
on another note,

i just found another Question that have same symptom like me:
https://community.cisco.com/t5/network-access-control/cisco-ise-instalation-error/td-p/3091127

perhaps i would try suggested on that Thread

Or if that's not work,
is there any solution regarding this ?
*beside change the hypervisor from Sangfor HCI

[Arne Bier]

@ahollifield is right.

I think that ISE is particularly fussy about the underlying hardware and it performs checks. Even though, technically, any hypervisor that provides X86_64 support should handle the job (the redhat linux used by ISE must have kernel and driver support), ISE will refuse to support this.

Same thing happens when you want to run ISE on your home lab using Oracle VirtualBox (very famous and capable hypervisor) - ISE refuses to install.  Cisco does things like this to reduce the operational burden on their support staff, by limiting the scope down to a handful of hypervisors.

[Arne Bier]

If you're doing this for a production system then you're fighting a losing battle - don't waste your time.

If it's out of curiosity (or lab) then go ahead and hack away. There might be a way. You might not get much help or sympathy on this forum, because ISE is designed to work within those tight guard rails.

[Agung1007]

Hi @Arne Bier 
thanks for the reply.

Yes, 
we are doing this to replace production ISE 2.7 on our customer.

What about the UNSUPPORTED that ISE shows when we try to install the .ova on Hypervisor Sangfor HCI ?
*it can be installed and running well, but it shows UNSUPPORTED on PID / Serial Number of ISE ; unable to retrieve the license form SSM server 

Is it due installation .ova on the sangfor HCI? or is it something that i missing ?

Many thanks.

[Arne Bier]

If you managed to install ISE on the Sangfor HCI platform, then it doesn't mean you have complete success, because as your screenshot demonstrates, the ISE application was unable to find the expected hardware platform details from the Linux OS.  The issue is the hypervisor used on the Sangfor HCI.   Other HCI solutions like Nutanix, support either VMWare ESXi as hypervisor, or AVH (Nutanix own hypervisor) - both are supported by ISE. But no support for Sangfor.  That means you won't have ny joy with getting those ISE nodes licenced.

[Agung1007]

Hi Arne

Ok got it Sir.

Many thanks for the info n input.

Parallel i will ask the TAC engineer in case they have another solution

*or convince our customer to do another method/prepare another Hypervisor

[ahollifield]

TAC will tell you its not a supported hypervisor.  Like @Arne Bier says, if this is for a production system, the customers only choice is to use a different hypervisor or purchase SNS appliances.