All, I have 4 ISE appliances version 1.1.2  running in my networ called nodeA, nodeB, nodeC and nodeD.  - NodeA is Primary Admin and Secondary Monitoring, - NodeB is Secondary Admin and Primary Monitoring, - NodeC is Policy node, - NodeD is Policy node, The ISE environment is tightly integrated with the company Microsoft Active Directory Windows 2008R2.  We import the company issue cert into the ISE for PEAP and CRL checking Question:  How often does the ISE perform CRL checking with the Certiticate Authority (CA) Server?  I also have an ACS environment that also tightly integrated with Microsoft AD.   How often does the ACS peform CRL checking with the Certificate Authority (CA) Server? What will happen to the ISE and ACS environment if the CA Server becomes un-available? I can't seem to find this question in either ISE or ACS documentation anywhere.  Thank you. ... View more

I have an ISE version 1.1.2.145 Patch-5 running in standalone mode.  No one has access to the ISE appliance except myself.  The ISE has an IP address of 1982.168.1.1 today, I noticed that the ISE is attempting to make an outbound http to an unknown Internet IP address of files.liferay.com.  Fortunately, my checkpoint firewall does not allow this connection: Number:                          99427 Date:                           17Nov2013 Time:                              23:03:11 Interface:                        eth2 Origin:                         Corp_Firewall Type:                              Log Action:                         Drop Service:                          http (80) Source Port:                    58025 Source:                           Corp_Firewall-192.168.1.1 (192.168.1.1) Destination:                    files.liferay.com (38.75.15.3) Protocol:                         tcp Rule:                           100 Rule UID:                        {1234abcd-1111-xxxx-vvvv-aaaaaaaaaa} Rule Name:                    Corp_Firewall Log Drop rule Current Rule Number:        100-Corp_Firewall Product:                          Security Gateway/Management Product Family:              Network Policy Info:                     Policy Name: Corp_Firewall                                 Created at: Sat Nov 16 01:30:50 2013                                 Installed from: corp-mgmt-192.168.1.2 The question is why the ISE is doing this?  What is the purpose for this http connection, some kind of "back door" by Cisco? ... View more

Hi everyone, I have Windows 2008 32-bits on a Dell 2950 with dual CPU quad cores, 16GB of RAM and 500GB of diskspace.  I am installing Cisco CSM version 4.4 service pack 2 on this system.  The performance is very poor.  I am only managing about three devices. Anyone knows why? ... View more

Need help from ISE experts/gurus in this forum. Due to a nasty bug in Cisco ISE (bug ID CSCue38827 ISE Adclient daemon not initializing on leave/join), this bug will make the ISE stopping working completely and a reboot is required (very nice bug from cisco) .  This leaves me no choice but to upgrade to version 1.2.0.899-2-85601.  Scenario:  - 4 nodes in the environment running ISE version 1.1.2.145 patch 3 - node 1 is Primary Admin and Secondary Monitoring - hostname is node1 - node 2 is Secondary Admin and Primary Monitoring - hostname is node2 - node 3 is Policy service node - hostname is node3 - node 4 is Policy service node - hostname is node4 Objective:  Upgrade the ISE environment to ISE version 1.2 with patch version 1.2.0.899-2-85601. My understand  is that I have to upgrade the existing environment from ISE version 1.1.2.145 patch 3 to ISE version 1.1.2.145 patch 10 (patch 10 was released on 10/04/2013) before I can proceed with upgrading to ISE version 1.2 and patch it with 1.2.0.899-2-85601.  Can I patch my exsiting environment from 1.1.2 patch 3 to patch 10 prior to upgrading to version 1.2.0.899-2-85601? I look at Cisco website and patch 10 was released on 10/04/2013 while version 1.2 was released back in 07/05/2013. I am trying to get a definite answer from Cisco TAC but it seems like they don't know either.  Question #1:  How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 3 to 1.1.2.145 patch 10? Propose solution:  step #1: make ISE node1 to be both Primary Admin and Primary monitoring.  ISE node2 is now Secondary Admin and Secondary Monitoring.           Then go ahead and apply ISE version 1.1.2.145 patch 10 to ISE node2 via the GUI, step #2: Once ISE node2 patch 10 is completed, make node2 Primary Admin and Primary Monitoring.  At this point, apply ISE 1.1.2.145 patch 10          to ISE node1 via the GUI, step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring, step #4: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node3.  Once that is completed, verify that node2 is working and accepting traffics, step #5: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node4.  Once that is completed, verify that node2 is working and accepting traffics, Question #2: How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 10 to ISE version 1.2 with patch version 1.2.0.899-2-85601? Propose solution: step #1:  Make ISE node1 the Primary Admin and Primary monitoring.  At this point ISE node2 will become Secondary Admin and Secondary Monitoring step #2:  Perform upgrade on the ISE node2 via the command line "application upgrade <app-bundle> <repository>".  Once ISE node2 upgrade is completed, it will           form a new ISE 1.2 cluster independent of the old cluster, step #3:  Perform upgrade on the ISE Policy Service node3 via the command line "application upgrade <app-bundle> <repository>".  After the upgrade the ISE           Policy Service Node3 will automatically joins the ISE node2 which is already in version 1.2 step #4:  Perform upgrade on the ISE Policy Service node4 via the command line "application upgrade <app-bundle> <repository>".  After the upgrade the ISE           Policy Service Node4 will automatically joins the ISE node2 which is already in version 1.2 step #5:  At this point the only node remaining in the 1.1.2.145 patch 10 is the ISE node1 Primary Admin and Primary Monitoring step #6:  Check and see if there are any more PSN's registered in ISE node1 (there should not be any) step #7:  Perform the upgrade on the ISE node1 from command line  "application upgrade <app-bundle> <repository>" step #8:  Once upgrade on ISE node1 is complete, ISE node1 will automatically join the new ISE 1.2 cluster, step #9:  Make ISE node1 Primary Admin and Secondary and ISE node2 Secondary Admin and Primary Monitoring, Question #3:  How do I proceed with upgrading the current ISE environment from 1.2 patch0 to 1.2.0.899-2-85601? Propose solution:  step #1: make ISE node1 to be both Primary Admin and Primary monitoring.  ISE node2 is now Secondary Admin and Secondary Monitoring.           Then go ahead and apply ISE 1.2.0.899-2-85601 to ISE node2 via the GUI, step #2: Once ISE node2 1.2.0.899-2-85601 is completed, make node2 Primary Admin and Primary Monitoring.  At this point, apply 1.2.0.899-2-85601          to ISE node1 via the GUI, step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring, step #4: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node3.  Once that is completed, verify that node2 is working and accepting traffics, step #5: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node4.  Once that is completed, verify that node2 is working and accepting traffics, does these steps make sense to you? Thanks in advance. ... View more