CSCwk79546 - ISE 3.3p3 DUO MFA authentication fails instantly

[pnavratil]

A can see in ISE release notes I need to install fix "HP_3.3P3.zip" but it is not available on Cisco download.

Is it realy required to open AC SR to get the fix?

Note: Another stupid mistake in javascript - how many such bugs was observed and how many will be obeserved? It seems to me the Cisco programmers should learn something better ...

[ccieexpert]

in this case it is not published externally. So, please open a TAC case and they can publish it for you.

**Please rate this and mark as solution/helpful, if this resolved your issue or is helpful**

[carllapointemedia]

Hello,

The link should be in ISE 3.3 patch 3, if you navigate to Administration > Identity Management > Settings > External Identity Sources Settings next to Multi Factor Authentification title there should be a message that you can click that will provide you with the link. Not sure if I can publish a link here but here it is :

https://software.cisco.com/download/specialrelease/e030234e8c6974bff3628178080fee50 

[pnavratil]

Hi - thenk you for your help. I just downloaded the patch file (ise-apply-CSCwk79546_3.3.0.430_patch3-SPA.tar.gz) - I tried to install it in CLI but it end with error:
----

ise/admin#patch install ise-apply-CSCwk79546_3.3.0.430_patch3-SPA.tar.gz TS-FTP
% Warning: Patch will be installed only on this node. Install using Primary Administration node GUI to install on all nodes in deployment. Continue? (yes/no) [yes] ?
Initiating Application Patch installation...

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
% Error: Application bundle detected. Please use application CLI for application installation or upgrade.
------
What is the right way to install the patch?

[marce1000]

 - Could you verify the md5sum (checksum) of the patch which you download (?)

  M.

[pnavratil]

I compute the checksum in windows (certutil -hashfile ...) - I do not know, where is the problem - the checksums are diffrernt for what is shown on Cisco download web page ad in MS CLI. I tried to download it 2 times - in both cases I downloaded the same file - the same checksum - I expect if it would be problem on transfer, it should lead to different checksums. ..

[Greg Gibbs]

Hot patches are installed (and removed) using the 'application install <file> <repository>' command.

You would want to ensure the integrity of the file before applying it, though, so having the MD5 hash mismatch would be a problem. Make sure whatever browser/application you are using to download the file is not automatically trying to unzip (untar) it.

I downloaded the file just now using Firefox and confirmed the hashes match what is published.

certutil -hashfile ise-apply-CSCwk79546_3.3.0.430_patch3-SPA.tar.gz md5
MD5 hash of ise-apply-CSCwk79546_3.3.0.430_patch3-SPA.tar.gz:
42de6faf5f3246b89553954ef5c11ec3

[carllapointemedia]

Not 100% about how to use the CLI for patch, we usually use the WebUI, maybe try that ?

In System > Maintenance > Patch management

[pnavratil]

I tried GUI too with the same result.