Issue
The Cisco Identity Services Engine(ISE) version 3.2 Patch 7 and 3.3 beta release guest portal intermittently stops functioning on Policy Service Nodes (PSNs) within the deployment with some nodes on a virtual machine (VM) and some on Azure. When this occurs, a stop/start of ISE services or manual sync of nodes from the GUI helps with restoring portal functionality. This problem is observed across multiple nodes in the environment.
Environment
- Product: Cisco Identity Services Engine (ISE)
- Software Version: 3.2 patch 7 and 3.3_BETA
- Recent Changes: Migration of nodes to a separate environment; migration of PAN and MNT from Azure to hardware appliances (SNS 3795)
- Network: Inter-node communication over TCP port 8671 is required.
Resolution
1. Ensure that each PSN node has sufficient CPU and memory resources allocated, especially those nodes that have exhibited service failures or performance degradation.If resource constraints are detected, increase CPU and/or memory allocation as needed.
2. Confirm that all PSN nodes can communicate over TCP port 8671, which is critical for node synchronization. Test connectivity between nodes on TCP port 8671 using telnet. A successful connection indicates that the port is open and reachable. If the connection fails, check firewall settings, routing, and network ACLs between nodes.
3. Manually sync the PSN node via the ISE GUI:
- Navigate to Administration > System > Deployment.
- Select the affected PSN and click Syncup (ISE PSN node services then restart).
4. Create a new Hotspot Portal:
- Navigate to Work Center > Guest Access > Portals & Components.
- Click Create and select Hotspot Portal.
- Configure basic settings, add a simple AUP, and set a post-login redirect URL.
- Save and test the new portal to validate functionality. If the new portal operates normally, this can indicate configuration issues with the original portal.
5. If profiler queue or resource-related alerts are present on nodes, like high CPU usage or queue link errors, increase hardware resources as needed. For example, increase the CPU allocation from 8 to 16vCPUs.
Note: This step is performed through your virtualization or cloud management interface.
6. After resource adjustment, monitor the system for improved stability.
7. Continue to monitor for queue link errors or similar warnings. If such errors persist but are sporadic and linked to ISP or network issues (not internal configuration or firewall), document occurrences for ongoing review. If errors are traced to external ISP issues, coordinate with network service providers as needed.
Cause
The primary cause of the ISE guest portal unresponsiveness is resource constraints (CPU/memory) on affected PSN nodes, as well as internode communication issues (TCP port 8671). Queue link errors are attributed to external ISP issues rather than internal network or firewall misconfigurations. Migration of nodes and hardware resource adjustments results in improved stability.
Related Content
Feedback