cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
432
Views
5
Helpful
5
Replies

ISE Health Checks

Matthew Martin
Contributor
Contributor

Hello All,

ISE v2.7 patch 3

I am looking to install the latest Patch for v2.7. I noticed under Administration > System > Upgrade there's a message that says "Deployment is not healthy. Check the health in HealthChecks page . Click continue to go to the upgrade page."

I know the patch install is done through Administration > System > Maintenance > Patch Management, and not the Upgrade page. But, I'm thinking it might be a good idea to run the Health Checks prior to installing the patch...

Can the Health Checks be run during business hours without impacting endpoints/clients on the network?

Thanks in Advance,
Matt

1 Accepted Solution

Accepted Solutions

Aref Alsouqi
Collaborator
Collaborator

Running ISE health check does not cause any interruption for your deployment. What ISE basically does with the health check is running a list of tasks, and based on the outcome it will judge if your deployment is healthy or not. That process won't have any auto-remediation or changes to your environment, hence, it is not disruptive.

View solution in original post

5 Replies 5

Aref Alsouqi
Collaborator
Collaborator

Running ISE health check does not cause any interruption for your deployment. What ISE basically does with the health check is running a list of tasks, and based on the outcome it will judge if your deployment is healthy or not. That process won't have any auto-remediation or changes to your environment, hence, it is not disruptive.

Matthew Martin
Contributor
Contributor

Great, thank you!

Ran the checks after I got your reply... Only took about a minute for the checks to complete.

Question. The Trust Store Certificate Validation has an exclamation point and shows "0/2"... I checked the Trusted Certificates page and don't see an expired Certs on that page or anything expiring anytime soon. Could that message mean something else?

You welcome. Does it show you the Trust Store Certificate Validation as failed or passed the health check? Usually you would see 0/x if the health check task fails, in that case you will see it flagged in red, but if you see it in green with 0/2 I would ignore it.

MatthewMartin_0-1670267297531.png

I think I found the certs it was warning about under Certificates > Certificate Authority Certificates. There's 2 for each of our 2 nodes. One shows for OCSP Responder and the other says "...Endpoint Sub CA...". See below:

MatthewMartin_1-1670267593321.png

I do see valid OCSP Responder and Endpoint Sub CA certs that are still valid. But, when I clicked to Delete one of these expired Certs I get the following message, which sounded a little scary so I clicked Cancel:

MatthewMartin_2-1670267824523.png

Thanks Again,
Matt

Aref Alsouqi
Collaborator
Collaborator

Hi Matt, you can renew those certs by going into the Certificate Signing Requests section. Once you click on generate the request, you can select the usage from the usage drop down menu, alternatively you can remove them if they are not in use. One thing to keep in mind is that an upgrade process will fail if you have any expired certificate on ISE, however, I don't believe this would be the case with applying the patches.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers