Image Integrity Check on VM

[samthada]

Hello,

I have a question about Secure Boot and the Image Integrity Check features that were introduced in 2.0.1.

The release notes for 2.0.1 clearly say that both Secure Boot and the Image Integrity Check features are only available on the physical appliance. My question is that in later version of ISE, is this still the case? I could understand why Secure Boot could only occur on the physical appliance, but I'm wondering why the image integrity check isn't included in the image when deploying ISE on a VM.

The real question is, in any version of ISE, does the image thats installed on the VM include the Image Integrity Check?

[hslai · Accepted solution]

You are correct that the secure boot feature is for ISE SNS appliances as our teams worked with the UCS teams to get it to work. If you have a business case for VM, as well, then please discuss it with our PM team. AFAIK, VMWare VM may support it but requires newer ESXi releases and VM hardware version -- Enable or Disable UEFI Secure Boot for a Virtual Machine

Nonetheless, many of ISE binary files are being checked for integrity since ISE 2.0.1, regardless SNS appliances or VM appliances.

[samthada]

Thanks for the response. I have a couple follow ups.

1. When does the integrity check take place?

2. What happens in the instance that the check fails?

3. What specific binaries does it check?

Thank again!

[hslai]

The checks are generally happening at the initialization stage. The ISE services will shut down if the checks failing. All the essential binary files are checked.