ISE 2.4 patch 14:s GUI fail after patching from patch 9.

[Magnus Rosenqvist]

Hello!

Got an interesting one. A VMware.based cluster(two nodes for each type) ISE 2.4 patch 9 now also patched with 14.

The patching goes well and the ISE works except for the website. All node are in sync and updated.

The website is stuck at login screen when trying to login but if you use the wrong password the website will tell you that it is wrong.

Cli works fine. Tried to 'reload node' and also separately 'application stop ise, application start ise'.

Both ways will allow you to login at the GUI but after perhaps 5-15min the website freeze and it is no longer possible to login.

Any ideas?

[marce1000]

                            - ...> website freeze

      At that point verify the status of the ISE deployment with this cli-command

                ise/admin# show application status ise

  M.

[Magnus Rosenqvist]

# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID
--------------------------------------------------------------------
Database Listener                      running          18882
Database Server                        running          75 PROCESSES
Application Server                     running          2580
Profiler Database                      running          22680
ISE Indexing Engine                    running          32595
AD Connector                           running          28284
M&T Session Database                   disabled
M&T Log Collector                      disabled
M&T Log Processor                      disabled
Certificate Authority Service          disabled
EST Service                            disabled
SXP Engine Service                     disabled
Docker Daemon                          running          23593
TC-NAC Service                         disabled

Wifi Setup Helper Container            disabled
pxGrid Infrastructure Service          disabled
pxGrid Publisher Subscriber Service    disabled
pxGrid Connection Manager              disabled
pxGrid Controller                      disabled
PassiveID WMI Service                  disabled
PassiveID Syslog Service               disabled
PassiveID API Service                  disabled
PassiveID Agent Service                disabled
PassiveID Endpoint Service             disabled
PassiveID SPAN Service                 disabled
DHCP Server (dhcpd)                    disabled
DNS Server (named)                     disabled
ISE RabbitMQ Container                 running          24240

Thx for reading and responding to my post.

[marce1000]

 - You may also want to look at ade.log with :

            show logging system ade/ADE.log

  look for anomalies, if any.

 M.

[Magnus Rosenqvist]

Unfortunely nothing out of the ordinary. 

Also used show logging system ade/ADE.log tail during a freeze without any new logs at that time.

[Marcelo Morais]

Hi @Magnus Rosenqvist ,

 worth the shot to double check if your Host has Snapshot or vMotion enabled.

Note: for more information: ISE Installation Guide, 2.6. search for VMware Virtual Machine Requirements.

Hope this helps !!!

[Magnus Rosenqvist]

Tried and the hosts had both off.

Did found that the VMs had far too little resources assigned so I changed that. Thanks.

It did not fixed my issue though.

[marce1000]

                         >....Did found that the VMs had far too little resources assigned so I changed that.

   - Did you follow-up on resource-usage afterwards ? Did any new resource-issues appear ? How is the login screen stuck , you may want to add a screenshot (e.g.). Try to fetch the login screen with wget (for instance)  - what happens then ? 

                         https://linux.die.net/man/1/wget

 M.

[Magnus Rosenqvist]

Added a screenshot in the first post.

The resource-usage is so low that I do not see how that could effect anything.

As for wget. It had no problems.

wget --no-check-certificate https://domain-ise.domain.se/
--2021-08-20 13:13:27--  https://domain-ise.domain.se/
Resolving domain-ise.domain.se (domain-ise.domain.se)... 10.68.233.86
Connecting to domain-ise.domain.se (domain-ise.domain.se)|10.68.233.86|:443... connected.
WARNING: cannot verify domain-ise.domain.se's certificate, issued by ‘CN=domainRootCA 2016,DC=domain,DC=se’:
  Self-signed certificate encountered.
HTTP request sent, awaiting response... 302 Found
Location: https://domain-ise.domain.se:443/admin/ [following]
--2021-08-20 13:13:27--  https://domain-ise.domain.se/admin/
Reusing existing connection to domain-ise.domain.se:443.
HTTP request sent, awaiting response... 302 Found
Location: /admin/login.jsp [following]
--2021-08-20 13:13:27--  https://domain-ise.domain.se/admin/login.jsp
Reusing existing connection to domain-ise.domain.se:443.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html                        [ <=>                                              ]  26.46K  --.-KB/s    in 0s

2021-08-20 13:13:27 (444 MB/s) - ‘index.html’ saved [27099]

[marce1000]

 - So that hints me, that something hangs, in the context of the login-process , is the particular admin-account (mgmt-maro) ,locally defined or defined as a 'remote admin' , served by radius or ad. In that case , you may want to check the logs of the used authenticating services for the particular administrator account  (like for instance , is there an auth-attempt ? , does it fail or succeed....?)

 M.

[hslai · Accepted solution]

See SOFTWARE ADVISORY NOTICE on CSCvy53361 for ISE 2.4 Patch 14

[Magnus Rosenqvist]

GUI works again. Thanks for everyones help!

[fcabianca]

Hello, how did you get it fixed?
We have the same problem. Thank you.

[Marcelo Morais]

Hi @fcabianca ,

 please remember the following (take a look at ISE 2.4 Release Notes

Hope this helps !!!

[Magnus Rosenqvist]

I downloaded the file in hslai's link and followed the instructions in the file on how to install it.