ISE 2.4 upgrade bundle failing to successfully download to existing 2.3 nodes

[jelin]

Hi experts,

  Trying upgrade my ISE 2.3p3 nodes (2 X PAN and 1 x PSN) from 2.3p3 to 2.4 via the upgrade bundle, ise-upgradebundle-2.0.x-2.3.x-to-2.4.0.357.SPA.x86_64.tar.gz.   Getting error message: "Unbundling Application Package... % Unable to unbundle the package. It should be tar.gz file format. ***cmd exec error ***"

1. Ran URT on standby PAN with no errors.  Everything was successful.

2. compared my 2.4 upgrade bundle file MD5 hash to published MD5 hash.  Both match perfectly.

3. My FTP respository validates fine. 

4. I have HTTP repository setup as well (ISE GUI doesn't support validation for http unfortunately)

5. Based on older posts, I tried to rename the 2.4 upgrade bundle file name from tar.gz to *.gz but that didn't help.

Problem:  1.  When trying to select 2.4 upgrade bundle via HTTP repository, the 2.4 upgrade bundle is not available.  But if I use the browser to verify, I can see the 2.4 upgrade bundle available.

Problem 2:  When using FTP repository, the 2.4 upgrade bundle is downloaded to the PSN or standby PAN but it results in "Unbundling Application Package... % Unable to unbundle the package. It should be tar.gz file format. ***cmd exec error ***" .

Anyone?

Jerry

[hslai]

Let's connect offline to look at this on your availability.

[jelin · Accepted solution]

Thanks to Hsing's help!  Looks like the 3Comdaemon FTP service is having trouble serving a 9GB file.  After trying out a linux FTP server, the download successfully worked!    

[Damien Miller]

Filezilla server edition (not client) also works very well in a pinch.  Free and easy to use for the Windows folks. 

[Alex Pfeil]

I was going to use Filezilla so it looks like I should not run into this issue. Thanks!

[ajc]

I just tried that using Filezilla, no luck, see next:

This is the 2nd FTP app I use. The regular one I used in the past always worked fine.

[ajc]

More information

[Damien Miller]

I see it disconnect from the FTP server at 5 minutes/300 seconds. ISE does not actively disconnect FTP connections after 5 minutes, but where I have seen this before is when there is an F5 load balancer inline. The default TCP connection timeout value will close the FTP connection at 5 minutes on the dot. Adjusting the TCP settings on the F5 resolved it for me.

Is there any firewall or load balancer in the path of the node between it and the FTP server? If you try again, does it always close at 5 minutes elapsed?

You have Filezilla set up correctly and I have no reason to suspect the ftp server software is the issue here.

[ajc]

Thanks for the quick response and suggestion. In fact, we have an F5 with the forwarding policy which uses the default protocol profile = fastL4. That profile by default has a IDLE TIMEOUT of 300 seconds. We changed it to 3600 and it worked. Now the question is: "IF this profile has an IDLE TIMEOUT", why did it fail if I am transferring data from PC FTP Server to ISE Node so no IDLE condition should be hit?

[Damien Miller]

I'd love to know the answer to that too, I would not have expected an idle timeout to impact these established flows but it does. F5 knowledge base articles are not clear on what is required to reset the idle timeout in the connection table. I suspect that the F5 is looking for a TCP handshake to reset this timer. I am by no means an F5 expert so I can't answer this any better, I'm certainly being forced to learn more of it as ISE deployments push up in size.

The F5 connection reaper process cleans up idle sessions within 7 seconds of the timeout value, so at least the F5 is "working".

[ajc]

Unfortunately , the upgrade using GUI failed. Now I need to troubleshoot this part.

[pnowikow]

I had this same issue with TFTPD64 so I switched to FileZilla and it's working now.  I also noticed my files was blocked in the properties in Windows Explorer.  I Unblocked it and it's uploading to ISE node now.  Fingers crossed.

[chanthornloeurt]

Dear community,

I'm trying to complete this step but it takes time too long that's why I canceled the process and can't process to continue downloading anymore. Do you have any advice on this?

[ajc]

what version are you trying to upgrade into?. I am not using that GUI option anymore