ISE GUI stucking on login page

[Spyros Kasapis]

Hello ,

we have ISE 2.6 patch 9 and every week ISE gui stucking on login page.

It is not accepting neither AD or local credentials .

Everything works fine but i am unable to login in gui .

From cli , in show logging command  , when i am trying to connect  i am getting the following message .

iseadminportal: notice:[application:operation:cpmadjustfw.sh] Close rabbitmq firewall from this node to all other nodes by flushing ipset .

i do not know how related is this .

[Marcelo Morais]

Hi @Spyros Kasapis ,

 please ...

1st, via the show application status ise command, check for any Process with Status - not running.

2nd, if you are using Chrome, select More Tools > Developer Tools, and try to login via a Internal Account, check for Pending status:

Hope this helps !!!

[Spyros Kasapis]

Hello Marcelo ,

the services are all up and running , a restart fixed the issue but after one week it happened again .

What causes the pending status you mentioned ?

Thanks for your help ,

Spyros

[Marcelo Morais]

Hi @Spyros Kasapis ,

 I did a quick PrtScr to show you an example of a Pending status, in other words, after a few seconds I received a 200 OK ... in your case, the Pending status should "stay stuck", check the Initiator column for a better understand of which point it "got stuck".

Hope this helps !!!

[Spyros Kasapis]

Hello Marcelo ,

it stuck  in LoginAction.do

[Marcelo Morais]

Hi @Spyros Kasapis ,

 please 1st ... put the mouse on the LoginAction.do ... check the info (are you using IP Addr or Hostname?

 2nd .. open PAN via SSH and enter the following command:

tech dumptcp 0 | inc <PAN IP Addr>.443|inc <Your PC IP Addr>

 3rd ... open PAN via HTTPS and enter the user/pass, check if you are receiving packets on your SSH screen (you are "stuck" because ISE is not receiving the packet or because ISE is not processing it?)

Hope this helps !!!

[Spyros Kasapis]

Hello Marcelo and thank you !!

i am using an ip address to access ISE , the traffic is initiated , ISE is receiving traffic . When i am trying to connect with wrong password i get an error message but when i am putting the correct credentials it looks like that i do not get a response ..

[Marcelo Morais]

Hi @Spyros Kasapis ,

 at SSH check for the LoginAction info at ISE-PSC.LOG, search for errors and others:

ise/admin# show logging application ise-psc.log
...
2021-09-22 18:17:42,963 INFO [admin-http-pool127][] cpm.admin.infra.spring.ISEAdminControllerUtils -::::- Empty or null forwardStr for: https://<Primary PAN IP Addr>/admin/LoginAction.do 
...

Hope this helps !!!

[Spyros Kasapis]

Hello Marcelo ,

the answer from TAC is that it is a well known bug for version 2.6   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvy53361  .

[martin.fischer · Accepted solution]

Hi @Spyros Kasapis 

This is a known bug in version 2.6 Patch 9.

See release notes of 2.6 > Open Caveats in Cisco ISE Release 2.6.0.156 - Cumulative Patch 9:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/release_notes/b_ise_26_RN.html#Cisco_Concept.dita_c2897783-242d-4f77-813e-a102ca34f8d8

PAN login page times out after entering the credentials (CSCvy53361) 

Best regards