How to Export Configuration and Operation Data Backup from ISE

Available Languages

Download Options

  • PDF     (506.9 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (517.6 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (456.6 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:June 4, 2020
Document ID:215355

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to take On-Demand Configuration data and Operation data backup of the Identity Service Engine (ISE).

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of these topics:

    • Basic knowledge of the Identity Service Engine (ISE).
    • How to configure a Repository.

    Components Used

    The information in this document is based on these software and hardware versions:

    • Cisco Identity Service Engine 2.7

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

    Background Information

    Another key strategy to assure the availability of ISE in the environment is having a solid backup strategy. There are two types of ISE backups: configuration backup and operational backup.

    Cisco ISE allows you to back up data from the Primary PAN and from the Monitoring node. Back up can be done from the CLI or user interface.


    Configuration data- Contains both application-specific and Cisco ADE operating system configuration data. Back up can be done via the Primary PAN using the GUI or CLI.


    Operational Data- Contains monitoring and troubleshooting data. Back up can be done via the Primary PAN GUI or using the CLI for the Monitoring node.

    The backups are stored in a repository and can be restored from the same repository. You can schedule backups to run automatically or you can run them manually on demand. You can view the status of a backup from either the GUI or the CLI, but you can view the status of a restore only from the CLI.

    Caution: Cisco ISE does not support VMware snapshots for backing up ISE data. Using VMware snapshots or any third-party backup to back up ISE data results in stopping Cisco ISE services.

    Configuration

    Perform On-Demand ISE Configuration Data Backup From GUI

    Step 1. Configure a repository refer How to configure Repository on ISE

    Step 2. Login to ISE , Navigate to Administration > System > Backup & Restore, select Configuration Data Backup, click Backup Now, as shown in the image:

    Step 3. Provide Backup Name, Repository Name and Encryption Key, and click Backup.

    Tip: Ensure that you remember the encryption key.

    Note: ISE configuration backup contains system and trusted certificates and it doesn't contain internal Certificate Authority (CA) certificates.

    In order to backup the internal Certificate Authority (CA) store manually from the ISE CLI. Login to ISE Primary Admin Node (PAN)  node via SSH and run command application configure ise  > select option 7 to Export Internal CA Store.

    ise/admin# application configure ise

Selection configuration option
[1]Reset M&T Session Database
[2]Rebuild M&T Unusable Indexes
[3]Purge M&T Operational Data
[4]Reset M&T Database
[5]Refresh Database Statistics
[6]Display Profiler Statistics
[7]Export Internal CA Store
[8]Import Internal CA Store
[9]Create Missing Config Indexes
[10]Create Missing M&T Indexes
[11]Enable/Disable ACS Migration
[12]Generate Daily KPM Stats
[13]Generate KPM Stats for last 8 Weeks
[14]Enable/Disable Counter Attribute Collection
[15]View Admin Users
[16]Get all Endpoints
[17]Enable/Disable Wifi Setup
[18]Reset Config Wifi Setup
[19]Establish Trust with controller
[20]Reset Context Visibility
[21]Synchronize Context Visibility With Database
[22]Generate Heap Dump
[23]Generate Thread Dump
[24]Force Backup Cancellation
[25]CleanUp ESR 5921 IOS Crash Info Files
[0]Exit

7
Export Repository Name: FTP-Repo
Enter encryption-key for export: 
Security Protocol list Start
Inside Session facade init
Old Memory Size : 7906192
Old Memory Size : 7906192
Export in progress...
Old Memory Size : 7906192

The following 5 CA key pairs were exported to repository 'FTP-Repo' at 'ise_ca_key_pairs_of_ise':
        Subject:CN=Certificate Services Root CA - ise
        Issuer:CN=Certificate Services Root CA - ise
        Serial#:0x08f06033-2a4c4fcc-b297e75a-04f11bf9

        Subject:CN=Certificate Services Node CA - ise
        Issuer:CN=Certificate Services Root CA - ise
        Serial#:0x3a0e8d8a-5a2846be-a902c280-b5d678aa

        Subject:CN=Certificate Services Endpoint Sub CA - ise
        Issuer:CN=Certificate Services Node CA - ise
        Serial#:0x33b14150-596c4552-ad0a9ab1-9541f0bb

        Subject:CN=Certificate Services Endpoint RA - ise
        Issuer:CN=Certificate Services Endpoint Sub CA - ise
        Serial#:0x37e17494-cf1d4372-bf0ba1e6-83653826

        Subject:CN=Certificate Services OCSP Responder - ise
        Issuer:CN=Certificate Services Node CA - ise
        Serial#:0x68a694ed-bc48481d-bc6cc58e-60a44a61

ise CA keys export completed successfully

    Perform On-Demand ISE Configuration Data Backup from CLI

    Step 1. Configure a repository refer How to configure Repository on ISE

    Step 2. Login to CLI of PAN node and run the command:

     backup <backup file name> repository <repository name> ise-config encryption-key plain <encryption key>

    ise/admin# backup ConfigBackup-CLI repository FTP-Repo ise-config encryption-key plain <backup password>
% Internal CA Store is not included in this backup. It is recommended to export it using "application configure ise" CLI command 
% Creating backup with timestamped filename: ConfigBackup-CLI-CFG10-200326-0705.tar.gpg 
% backup in progress: Starting Backup...10% completed 
% backup in progress: Validating ISE Node Role...15% completed
% backup in progress: Backing up ISE Configuration Data...20% completed
% backup in progress: Backing up ISE Indexing Engine Data...45% completed
% backup in progress: Backing up ISE Logs...50% completed
% backup in progress: Completing ISE Backup Staging...55% completed
% backup in progress: Backing up ADEOS configuration...55% completed 
% backup in progress: Moving Backup file to the repository...75% completed 
% backup in progress: Completing Backup...100% completed 
ise/admin#

    Perform On-Demand ISE Operational Data Backup from GUI

    Step 1. Configure a repository refer How to configure Repository on ISE

    Step 2. Initiate ISE operational backup.

    Login to ISE GUI, Navigate to Administration > System > Backup & Restore, select Operational Data Backup, click Backup Now, as shown in the image:

    Step 3. Provide Backup Name, Repository Name and Encryption Key, and click Backup.

    Tip: Ensure that you remember the encryption key.

    Perform On-Demand ISE Operational Data Backup from CLI

    Step 1.Configure a repository refer How to configure Repository on ISE

    Step 2. Login to CLI of Primary MNT node and run the command:

    backup <backup file name> repository <repository name> ise-operational encryption-key plain <encryption key>

    ise/admin# backup Ops-Backup-CLI repository FTP-Repo ise-operational encryption-key plain <backup password>
% Creating backup with timestamped filename: Ops-Backup-CLI-OPS10-200326-0719.tar.gpg
% backup in progress: Starting Backup...10% completed
% backup in progress: starting dbbackup using expdp.......20% completed
% backup in progress: starting cars logic.......50% completed
% backup in progress: Moving Backup file to the repository...75% completed
% backup in progress: Completing Backup...100% completed
ise/admin#

    Verify

    Navigate to Administration > System > Backup & Restore to view Configuration Data Backup progress, as shown in the image:

    Navigate to Administration > System > Backup & Restore In order to review Operational Data Backup progress , as shown in the image:

    You can also check the progress of the configuration backup from the CLI of the PAN node.

    ise/admin# show backup status 
%% Configuration backup status
%% ----------------------------
%      backup name: ConfigBackup-CLI
%       repository: FTP-Repo
%       start date: Thu Mar 26 07:05:11 IST 2020
%        scheduled: no
%   triggered from: CLI
%             host: 
%           status: Backup is in progress
%       progress %: 50
% progress message: Backing up ISE Logs

%% Operation backup status
%% ------------------------
%  No data found. Try 'show backup history' or ISE operation audit report
ise/admin#

    Once the backup is completed you can see the Backup Status as  success.

    Troubleshoot

    Ensure  ISE Indexing Engine  service is running on the  ISE Admin nodes.

    ise-1/admin# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
Database Listener                      running          15706       
Database Server                        running          89 PROCESSES
Application Server                     running          25683       
Profiler Database                      running          23511       
ISE Indexing Engine                    running          28268       
AD Connector                           running          32319       
M&T Session Database                   running          23320       
M&T Log Processor                      running          16272

    To debug the backup restore on ISE use following debugs:

    ise-1/admin# debug backup-restore backup ?
  <0-7>  Set level, from 0 (severe only) to 7 (all)
  <cr>   Carriage return.

ise-1/pan# debug backup-restore backup 7
ise-1/pan#
    ise-1/pan# 6 [25683]:[info] backup-restore:backup: br_history.c[549] [system]: ISE backup/restore initiated by web UI as ise.br.status is 'in-progress' in /tmp/ise-cfg-br-flags
    7 [25683]:[debug] backup-restore:backup: br_backup.c[600] [system]: initiating backup Config-Backup to repos FTP-Repo
    7 [25683]:[debug] backup-restore:backup: br_backup.c[644] [system]: no staging url defined, using local space
    7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area
    7 [25683]:[debug] backup-restore:backup: br_backup.c[673] [system]: creating /opt/backup/backup-Config-Backup-1587431770
    7 [25683]:[debug] backup-restore:backup: br_backup.c[677] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/cars
    7 [25683]:[debug] backup-restore:backup: br_backup.c[740] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/ise
    7 [25683]:[debug] backup-restore:backup: br_backup.c[781] [system]: calling script /opt/CSCOcpm/bin/isecfgbackup.sh
    6 [25683]:[info] backup-restore:backup: br_backup.c[818] [system]: adding ADEOS files to backup
    6 [25683]:[info] backup-restore:backup: br_backup.c[831] [system]: Backup password provided by user
    6 [25683]:[info] backup-restore:backup: br_backup.c[190] [system]: No post-backup entry in the manifest file for ise
    7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area
    6 [25683]:[info] backup-restore:backup: br_backup.c[912] [system]: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success
    6 [25683]:[info] backup-restore:backup: br_history.c[487] [system]: updating /tmp/ise-cfg-br-flags with status: complete and message: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success

    Use  no debug backup-restore backup 7  to disable debugs on the node.

    ise-1/admin# no debug backup-restore backup 7
    TAC Authored

    Contributed by Cisco Engineers

    • Pankaj Kumar
      Cisco TAC Engineer
    • Prashant Joshi
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products