deploying cisco ISE VM in Azure - Admin portal not loading

[TedB123]

hi

ive deployed a cisco ISE VM from the azure marketplace and followed the steps from this guide.

https://www.cisco.com/c/en/us/td/docs/security/ise/ISE_on_Cloud/b_ISEonCloud/m_ISEonAzureServices.html#concept_bft_42r_lsb

the deployment was successful and i can see that the VM is running and i saw no errors pop up.
in the guide it says that i now need to log into the ISE admin Portal to confirm that ISE is up and running... unfortunately i cannot access the portal via the https url

https://iseIP/admin

can somebody confirm if this is the correct URL to use?

the management server im using is on the same subnet as the ISE VM. I can confirm that inter subnet connectivity is allowed.

im not sure if ive missed something... can anybody advise on this?

cheers!

[poongarg]

The URL is correct. To check for GUI issue, login to CLI of ISE and check "show application status ise" and check the "application server", "ISE API Gateway Database Service" and "ISE API Gateway Service". They should be running.

[TedB123]

when i run show application status ise it says that show is not a command

-bash-4.4$ show application status ise
-bash: show: command not found
-bash-4.4$

not sure where to go from here.... do i really need to have an external public IP enabled on this node?

[Charlie Moreton]

If you're getting a bash prompt, something went wrong and ISE did not install correctly.  Did you populate the User data?

No, you do not need a public IP

[TedB123]

yeah i assume something wasnt loading correctly during the deployment

in regards to the user data, yes i entered in the following
password that ive entered here meets the password complexity requirements.

hostname=ISE01
primarynameserver=DC.domain.com
dnsdomain=domain.COM
ntpserver=DC.domain.com
timezone=Etc/UTC
password=randompassword
ersapi=no
openapi=no
pxGrid=no
pxgrid_cloud=no

maybe one of these isnt entered in correctly or i got the syntax wrong?

[TedB123 · Accepted solution]

omg i just noticed that the primarynameserver has to be an IP... no mention of entering fqdn here... 

primarynameserver: Enter the IP address of the primary name server. Only IPv4 addresses are supported.

maybe this is the issue... 

[Charlie Moreton]

Ahh, yes, that is a subtle requirement....and not a nice one  

[Charlie Moreton]

The syntax looks correct for the User data.  At this point, I'd delete this deployment and try again.

[TedB123]

yep im redeploying now but i changed the FQDNs and just put the IPs in... and guess what

its working now... im on the console of the vm and show application status ise is loading
i can see that a lot of services are currently in the 'not running' state, no doubt everything is still booting up 

i know ise can take a bit of time to load up so i will wait and try again in 20 min or so

ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 18279
Database Server running 92 PROCESSES
Application Server not running
Profiler Database not running
ISE Indexing Engine not running
AD Connector not running
M&T Session Database not running
M&T Log Processor not running
Certificate Authority Service not running
EST Service not running
SXP Engine Service disabled
TC-NAC Service disabled
PassiveID WMI Service disabled
PassiveID Syslog Service disabled
PassiveID API Service disabled
PassiveID Agent Service disabled
PassiveID Endpoint Service disabled
PassiveID SPAN Service disabled
DHCP Server (dhcpd) disabled
DNS Server (named) disabled
ISE Messaging Service not running
ISE API Gateway Database Service not running
ISE API Gateway Service not running
ISE pxGrid Direct Service not running
Segmentation Policy Service disabled
REST Auth Service disabled
SSE Connector disabled
Hermes (pxGrid Cloud Agent) disabled
McTrust (Meraki Sync Service) disabled
ISE Node Exporter not running
ISE Prometheus Service not running
ISE Grafana Service not running
ISE MNT LogAnalytics Elasticsearch disabled
ISE Logstash Service disabled
ISE Kibana Service disabled

[thomas]

There are typically 2 IPs in a cloud environment - a public IP and a private IP. Be sure you are using the public IP.

The real issue is most likely your Security Group (SG) permissions. Verify you are allowing HTTPS inbound into your ISE VM from the Internet.

[TedB123]

sorry for the delayed reply.. ive been away on holidays.

why do we have to use a public IP to connect to this device?  why cant we use the private IP which is what we currently have enabled...
public IP has not been configured.

the management server and this ISE node sit in the same subnet/vlan so they are right next to each other..  surely i should be able to access the web GUI via the internal private IP as well not just the public?

[Damien Miller]

Also make sure you use an admin password that meets the complexity requirements or the application server will not start after install. You can find the requirements here. 
https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/admin_guide/b_ise_admin_3_2/b_ISE_admin_32_deployment.html#ID649

[TedB123]

hopefully the password i set will allow me to log in... if not ill try again.
im going to redeploy this into its proper landing zone anyways as im currently testing the process.

cheers for the link Damien