Restarting ISE application server

[russell.sage]

Hi

Other than preventing access to the administration web page what other impact does restarting the application server have?

Does it take out all web services? by that I mean users portals.

I went to disable the TLS 1.0 and TLS1.1 in security settings and got a warning that Application server would restart on all nodes.

Not a problem other than I did not call this out in the change and my customer has a very strict change policy.

[Karsten Iwen]

The application server handles most of the basic functionality. While restarting, this node will be not available for a couple of minutes. It's a good test that will show that your redundancy concept is working. 

[Damien Miller]

I would recommend starting here in the Administration node high availability section. There is a table that indicates which services will be unavailable while the node is down. I would treat this as a node down impact.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_deployment.html#ID57

If your node also hosts other roles, then you should look at those sections too. If your PAN node also hosts the PSN role, then you will not have endpoint authentication during the application restart. 

[russell.sage]

Hi
Thanks for this. I had checked the 2.6 Admin guide. The Application Server process runs all 6 nodes 2*PAN+2*MnT+2*PSN. I was looking to disable Security settings following a Rapid7 scan. If I have to call out an outage that is fine I just didn't do that so had to abort the change.
What I can't seem to find is what functions other than the Admin GUI are impacted by the application server process restarting.
[cid:image001.png@01D767FF.3064E900]

[Marcelo Morais · Accepted solution]

Hi @russell.sage ,

 please compare the following command:

ise/admin# show ports

before and after the:

ise/admin# application stop ise

 you are able to verify a huge difference when you stop the Application Server.

Hope this helps !!!

[russell.sage]

Marcelo

Thanks for that.