Creating a USB Boot disk for fresh ISE 2.4 install on SNS appliance

[Arne Bier]

Hello ISE (appliance) installation experts

I need to create a bootable USB to install ISE 2.4 on 6 SNS-3595 servers.

I have a 16GB USB, the ISE 2.4 .iso and the Fedora Write software for Windows.

I have read the ISE 2.4 Installation Guide which talks about the Fedora Writer etc.

I happen to run a Windows operating system, and when I follow this procedure, I am able to "burn" the .iso to the USB successfully, using the Fedora Writer application (in Windows).  But the Installation Guide fails to point out that the USB is only visible when mounted on a Linux operating system!  I eventually figured that out and proceeded to launch my trusty CentOS VM.  I use VMWare Workstation and the contents of the drive become visible in the GUI as soon as I plug the USB in. But since this is an iso9660 file system (CDROM), it's protected from being written to.  The Installation Guide talks about editing two files - but I am unable to edit these because I haven't figured out how to mount this USB as anything other than a CDROM!

Can someone please let me know the error of my ways?  I want this sorted out before I get to customer site.  And in fairness, this has to be documented a bit better.

I would consider myself having quite good unix/Linux skills, but I am surprised at how tricky this is - and it looks so innocently easy in the Cisco docs.

[root@centos /]# mount /dev/sdb /mnt/usb -o rw -t auto
mount: /dev/sdb is write-protected, mounting read-only

[root@centos /]# mount | grep sdb
/dev/sdb on /mnt/usb type iso9660 (ro,relatime)

[root@centos /]# mount /dev/sdb /mnt/usb -o remount,rw
mount: cannot remount /dev/sdb read-write, is write-protected 

I have also tried mounting the USB as ext3 or ext4 instead of iso9660, but it refuses of course.

Apart from that, the documentation is wrong about one of the directory names - the syslinux reference is now called isolinux

[Damien Miller]

I have nothing to add that will help you with this. But i'm sure glad I have only seen one client buy physical appliances in the past few years, this is so much easier in VMware.

[Nadav]

For posterity's sake, I'll add my findings to the installation times via CIMC over the network.

I've checked this with the latest CIMC for 35x5 (3-0-4j).

Using JAVA KVM is significantly faster than installation via HTTP KVM:

Java: Roughly 20-25Mbps during installation

HTTP: Roughly 6-8Mbps during installation

During the installation, the amount of data copied from the workstation to the SNS via CIMC is roughly the size of the ISE installation .ISO file (at present, ~8GB).

Therefore Java can lower the network-heavy part of the installation (which requires copying the .ISO over the network) from over 3 hours to roughly an hour. 

I've seen installations work correctly for both Java and HTTP installs, so both seem to be reliable.

[Gioacchino]

Sorry for bringing back to life an old post, but is liveusb-creator 3.12.0 (maybe its most recent version) still theright tool to copy the ISO image to an USB key?

I tried the latest (3.95.2), but then after booting I got Kernel panic.

I tried 3.12.0 and then it halted with "Started cancel waiting for multipath sibling of sda."

TIA, Gio

[davidgfriedman]

Starting with ISE v2.7, I've successfully made USB bootable ISE drives (2.7 , 3.1 and 3.2) using either Rufus (https://rufus.ie ) or on my personal Chromebook using Chromebook Recovery.

[Gioacchino]

Hi @davidgfriedman ,

I have just found out that
https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/install_guide/b_ise_installationGuide32/b_ise_InstallationGuide32_chapter_4.html#r_tools_usb_creation
mentions RUFUS.
I'm giving it a try.

Thanks,

Gio

[Gioacchino]

Just a bit of feedback on this topic, for those who will read in the future. I faced a weird issue with a bootable USB key. It was flashed and its content was changed accordngly in order to reflect that the content was not read from the cdrom but from sdb1, being sda the main mass storage where ISE would be installed.
For 10-12 times the USB key was seen as a bootable device and hence there was no problem to boor from it.
all of the sudden, it was seen as mass storage (like not removable or fixed disk) and no matter what I could not boot from it, from the top of my mind I can say that the USB key was the same, as well as its content and BIOS settings were not changed.

The only solution was to flash another USB key (same model, weird!)

HTH

[andy!doesnt!like!uucp]

Hi Arne
have u managed to edit files finally? thank u

[Arne Bier]

Well I have not touched an SNS server since 2018. Perhaps the mistake I made back then was to try mount the .iso on a linux host, and then edit the file. I should have burnt the ISO to a USB stick, and then plugged the USB stick into a linux host and edited the lines that Cisco docs mention.

Cisco also mentions a different Media Creation Tool for various versions of ISE. Check out this link.