Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Configuration

Perform On-Demand ISE Configuration Data Backup From GUI

Perform On-Demand ISE Configuration Data Backup from CLI

Perform On-Demand ISE Operational Data Backup from GUI

Perform On-Demand ISE Operational Data Backup from CLI

Verify

Troubleshoot

Introduction

This document describes how to take On-Demand Configuration data and Operation data backup of the Identity Service Engine (ISE).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Basic knowledge of the Identity Service Engine (ISE).

- How to configure a Repository.

Components Used

The information in this document is based on these software and hardware versions:

- Cisco Identity Service Engine 2.7

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Another key strategy to assure the availability of ISE in the environment is having a solid backup strategy. There are two types of ISE backups: configuration backup and operational backup.

Cisco ISE allows you to back up data from the Primary PAN and from the Monitoring node. Back up can be done from the CLI or user interface.

Configuration data- Contains both application-specific and Cisco ADE operating system configuration data. Back up can be done via the Primary PAN using the GUI or CLI.

Operational Data- Contains monitoring and troubleshooting data. Back up can be done via the Primary PAN GUI or using the CLI for the Monitoring node.

The backups are stored in a repository and can be restored from the same repository. You can schedule backups to run automatically or you can run them manually on demand. You can view the status of a backup from either the GUI or the CLI, but you can view the status of a restore only from the CLI.

Caution: Cisco ISE does not support VMware snapshots for backing up ISE data. Using VMware snapshots or any third-party backup to back up ISE data results in stopping Cisco ISE services.

Configuration

Perform On-Demand ISE Configuration Data Backup From GUI

Step 1. Configure a repository refer How to configure Repository on ISE

Step 2. Login to ISE , Navigate to Administration > System > Backup & Restore, select Configuration Data Backup, click Backup Now, as shown in the image:

Step 3. Provide Backup Name, Repository Name and Encryption Key, and click Backup.

Tip: Ensure that you remember the encryption key.

Note: ISE configuration backup contains system and trusted certificates and it does not contain internal Certificate Authority (CA) certificates.

In order to backup the internal Certificate Authority (CA) store manually from the ISE CLI. Login to ISE Primary Admin Node (PAN)  node via SSH and run command application configure ise  > select option 7 to Export Internal CA Store.

ise/admin# application configure ise

Selection configuration option

[1]Reset M&T Session Database

[2]Rebuild M&T Unusable Indexes

[3]Purge M&T Operational Data

[4]Reset M&T Database

[5]Refresh Database Statistics

[6]Display Profiler Statistics

[7]Export Internal CA Store

[8]Import Internal CA Store

[9]Create Missing Config Indexes

[10]Create Missing M&T Indexes

[11]Enable/Disable ACS Migration

[12]Generate Daily KPM Stats

[13]Generate KPM Stats for last 8 Weeks

[14]Enable/Disable Counter Attribute Collection

[15]View Admin Users

[16]Get all Endpoints

[17]Enable/Disable Wifi Setup

[18]Reset Config Wifi Setup

[19]Establish Trust with controller

[20]Reset Context Visibility

[21]Synchronize Context Visibility With Database

[22]Generate Heap Dump

[23]Generate Thread Dump

[24]Force Backup Cancellation

[25]CleanUp ESR 5921 IOS Crash Info Files

[0]Exit

7

Export Repository Name: FTP-Repo

Enter encryption-key for export:

Security Protocol list Start

Inside Session facade init

Old Memory Size : 7906192

Old Memory Size : 7906192

Export in progress...

Old Memory Size : 7906192

The next 5 CA key pairs were exported to repository 'FTP-Repo' at 'ise_ca_key_pairs_of_ise':

Subject:CN=Certificate Services Root CA - ise

Issuer:CN=Certificate Services Root CA - ise

Serial#:0x08f06033-2a4c4fcc-b297e75a-04f11bf9

Subject:CN=Certificate Services Node CA - ise

Issuer:CN=Certificate Services Root CA - ise

Serial#:0x3a0e8d8a-5a2846be-a902c280-b5d678aa

Subject:CN=Certificate Services Endpoint Sub CA - ise

Issuer:CN=Certificate Services Node CA - ise

Serial#:0x33b14150-596c4552-ad0a9ab1-9541f0bb

Subject:CN=Certificate Services Endpoint RA - ise

Issuer:CN=Certificate Services Endpoint Sub CA - ise

Serial#:0x37e17494-cf1d4372-bf0ba1e6-83653826

Subject:CN=Certificate Services OCSP Responder - ise

Issuer:CN=Certificate Services Node CA - ise

Serial#:0x68a694ed-bc48481d-bc6cc58e-60a44a61

ise CA keys export completed successfully

Perform On-Demand ISE Configuration Data Backup from CLI

Step 1. Configure a repository refer How to configure Repository on ISE

Step 2. Login to CLI of PAN node and run the command:

backup <backup file name> repository <repository name> ise-config encryption-key plain <encryption key>

ise/admin# backup ConfigBackup-CLI repository FTP-Repo ise-config encryption-key plain <backup password>

% Internal CA Store is not included in this backup. It is recommended to export it using "application configure ise" CLI command

% Creating backup with timestamped filename: ConfigBackup-CLI-CFG10-200326-0705.tar.gpg

% backup in progress: Starting Backup...10% completed

% backup in progress: Validating ISE Node Role...15% completed

% backup in progress: Backing up ISE Configuration Data...20% completed

% backup in progress: Backing up ISE Indexing Engine Data...45% completed

% backup in progress: Backing up ISE Logs...50% completed

% backup in progress: Completing ISE Backup Staging...55% completed

% backup in progress: Backing up ADEOS configuration...55% completed

% backup in progress: Moving Backup file to the repository...75% completed

% backup in progress: Completing Backup...100% completed

ise/admin#

Perform On-Demand ISE Operational Data Backup from GUI

Step 1. Configure a repository refer How to configure Repository on ISE

Step 2. Initiate ISE operational backup.

Login to ISE GUI, Navigate to Administration > System > Backup & Restore, select Operational Data Backup, click Backup Now, as shown in the image:

Step 3. Provide Backup Name, Repository Name and Encryption Key, and click Backup.

Tip: Ensure that you remember the encryption key.

Perform On-Demand ISE Operational Data Backup from CLI

Step 1.Configure a repository refer How to configure Repository on ISE

Step 2. Login to CLI of Primary MNT node and run the command:

backup <backup file name> repository <repository name> ise-operational encryption-key plain <encryption key>

ise/admin# backup Ops-Backup-CLI repository FTP-Repo ise-operational encryption-key plain <backup password>

% Creating backup with timestamped filename: Ops-Backup-CLI-OPS10-200326-0719.tar.gpg

% backup in progress: Starting Backup...10% completed

% backup in progress: starting dbbackup using expdp.......20% completed

% backup in progress: starting cars logic.......50% completed

% backup in progress: Moving Backup file to the repository...75% completed

% backup in progress: Completing Backup...100% completed

ise/admin#

Verify

Navigate to Administration > System > Backup & Restore to view Configuration Data Backup progress, as shown in the image:

Navigate to Administration > System > Backup & Restore In order to review Operational Data Backup progress , as shown in the image:

You can also check the progress of the configuration backup from the CLI of the PAN node.

ise/admin# show backup status

%% Configuration backup status

%% ----------------------------

%      backup name: ConfigBackup-CLI

%       repository: FTP-Repo

%       start date: Thu Mar 26 07:05:11 IST 2020

%        scheduled: no

%   triggered from: CLI

%             host:

%           status: Backup is in progress

%       progress %: 50

% progress message: Backing up ISE Logs

%% Operation backup status

%% ------------------------

%  No data found. Try 'show backup history' or ISE operation audit report

ise/admin#

Once the backup is completed you can see the Backup Status as  success.

Troubleshoot

Ensure  ISE Indexing Engine  service is running on the  ISE Admin nodes.

ise-1/admin# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID

--------------------------------------------------------------------

Database Listener                      running          15706

Database Server                        running          89 PROCESSES

Application Server                     running          25683

Profiler Database                      running          23511

ISE Indexing Engine                    running          28268

AD Connector                           running          32319

M&T Session Database                   running          23320

M&T Log Processor                      running          16272

To debug the backup restore on ISE use these debugs:

ise-1/admin# debug backup-restore backup ?

<0-7>  Set level, from 0 (severe only) to 7 (all)

<cr>   Carriage return.

ise-1/pan# debug backup-restore backup 7

ise-1/pan#

ise-1/pan# 6 [25683]:[info] backup-restore:backup: br_history.c[549] [system]: ISE backup/restore initiated by web UI as ise.br.status is 'in-progress' in /tmp/ise-cfg-br-flags

7 [25683]:[debug] backup-restore:backup: br_backup.c[600] [system]: initiating backup Config-Backup to repos FTP-Repo

7 [25683]:[debug] backup-restore:backup: br_backup.c[644] [system]: no staging url defined, using local space

7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area

7 [25683]:[debug] backup-restore:backup: br_backup.c[673] [system]: creating /opt/backup/backup-Config-Backup-1587431770

7 [25683]:[debug] backup-restore:backup: br_backup.c[677] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/cars

7 [25683]:[debug] backup-restore:backup: br_backup.c[740] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/ise

7 [25683]:[debug] backup-restore:backup: br_backup.c[781] [system]: calling script /opt/CSCOcpm/bin/isecfgbackup.sh

6 [25683]:[info] backup-restore:backup: br_backup.c[818] [system]: adding ADEOS files to backup

6 [25683]:[info] backup-restore:backup: br_backup.c[831] [system]: Backup password provided by user

6 [25683]:[info] backup-restore:backup: br_backup.c[190] [system]: No post-backup entry in the manifest file for ise

7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area

6 [25683]:[info] backup-restore:backup: br_backup.c[912] [system]: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success

6 [25683]:[info] backup-restore:backup: br_history.c[487] [system]: updating /tmp/ise-cfg-br-flags with status: complete and message: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success

Use  no debug backup-restore backup 7  to disable debugs on the node.

ise-1/admin# no debug backup-restore backup 7