Configure Network File System Repository on ISE

Introduction

This document describes how to configure a Network File System (NFS) repository on Identity Services Engine (ISE).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• ISE 2.x.
• basic shell commands

Components Used

• ISE
• Debian distribution (used Ubuntu here)

Configure

Step 1. Set Up NFS on ubuntu

• You need first to install the nfs-kernel-server package on the ubuntu machine:

bara@ubuntu:~$ sudo apt-get update

bara@ubuntu:~$ sudo apt-get install nfs-kernel-server

• Create a shared directory called nfs:

bara@ubuntu:~$ sudo mkdir /var/nfs/general -p

• Change ownership to match nobody:nogroup

bara@ubuntu:~$ sudo chown nobody:nogroup /var/nfs/general

• Configure the ISE as a client on the NFS, with the directory to be exported:

bara@ubuntu:~$ more /etc/exports

# directory_to_share    client(share_option1,...,share_optionN) 

# /etc/exports: the access control list for filesystems which may be exported

#               to NFS clients.  See exports(5).

#

# Example for NFSv2 and NFSv3:

# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)

#

# Example for NFSv4:

# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)

# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)

• Open /etc/export with nano:

bara@ubuntu:~$ sudo nano /etc/exports

• Add the following two lines at the end (change the IP to ISE IP)

/var/nfs/general 10.48.85.249(rw,sync,no_subtree_check)
/home 10.48.85.249(rw,sync,no_root_squash,no_subtree_check)

• Save and close (Ctrl+x, when asked to save press Y and enter) then restart the NFS server using below command:

bara@ubuntu:~$ sudo systemctl restart nfs-kernel-server

Step 2. ISE Configuration

• Add the NFS repository to the ISE where /home/bara is the NFS mounting point

From the CLI:

ISE23S/admin(config)# repository NFS
ISE23S/admin(config-Repository)# url nfs://10.48.60.193:/home/bara

Note: Repositories configured from the CLI cannot be used from the ISE web UI and are not replicated to other ISE nodes.

From the GUI, go to Administration -> Maintenance -> Repository:

Note: NFS does not need username and password in this case, but since they are required in the form they must be added, any username and password can be entered.

Verify

• List all files in the NFS repository.

ISE23S/admin# show repository NFS
ise-support-bundle-przaise001-a-hv11674-11-04-2019-08-25.tar.gpg
jcameron-key.asc
test.txt

• On the NFS you can see the files:

bara@ubuntu:~$ pwd
/home/bara
bara@ubuntu:~$ ls
ise-support-bundle-przaise001-a-hv11674-11-04-2019-08-25.tar.gpg  jcameron-key.asc  test.txt

Known Defects

CSCvd73085:  Error mounting NFS location on ISE

CSCvk61086:  ISE 2.4 2.3 2.2 2.1 2.0 : NFS repository credentials are not used

CSCvk36814:  ISE 2.4 error mounting nfs repository

CSCvm41485:  ISE 2.3 : Unable to access NFS repository and scheduled reports not working using NFS repository

Troubleshoot

• To debug the repository on ISE use following debugs:

#debug copy 7
#debug transfer 7

• If #show rep NFS is failing, take captures and debugs, below is a screenshot of a working scenario:

Working

• Below is a non-working scenario, it could be that ISE isn’t listed in the /etc/exports