The Inline Posture node is supported only on Cisco SNS-3415 and Cisco ISE 3300 series appliances. It is not supported on Cisco SNS-3495 series or VMware server systems. All the other designated roles are supported for use on VMware virtual machines.
Cisco ISE supports the following VMware servers and clients:
VMware version 7 (default) for ESX/ESXi 4.x
VMware version 8 (default) for ESXi 5.x
VMware version 11 (default) for ESXi 6.0 (requires Cisco ISE 1.3 Patch 4)
Cisco ISE supports the cold VMware vMotion feature that allows you to migrate virtual machine (VM) instances (running any persona) between hosts. For the VMware vMotion feature to be functional, the following condition must be met:
Cisco ISE must be shutdown and powered off—Cisco ISE does not allow to stop or pause the database operations during vMotion. This might lead to data corruption issues. Hence, ensure that Cisco ISE is not running and active during the migration.
 Note |
Cisco ISE VM does not support Hot vMotion. |
Refer to your VMware documentation for more information on VMotion requirements.
 Caution |
If the Snapshot feature is enabled on the VM, it might corrupt the VM configuration. If this issue occurs, you might have to reimage the VM and disable VM snapshot. |
Note |
Cisco ISE does not support VMware snapshots for backing up ISE data because a VMware snapshot saves the status of a VM at a given point in time. In a multi-node Cisco ISE deployment, data in all the nodes are continuously synchronized with current database information. Restoring a snapshot might cause database replication and synchronization issues. We recommend that you use the backup functionality included in Cisco ISE for archival and restoration of data. Using VMware snapshots to back up ISE data results in stopping Cisco ISE services. A reboot is required to bring up the ISE node. |
Cisco ISE supports the Open Virtualization Format (OVF) and offers OVA templates that you can use to install and deploy Cisco ISE on virtual machines (VMs). The following OVA templates are available:
ISE-1.3.xxx.xxx-eval.ova—Use this template if you are evaluating Cisco ISE and the evaluation license would support up to 100 endpoints.
ISE-1.3.xxx.xxx-virtual-SNS3415.ova—Use this template if your VMware appliance specification is comparable with an SNS-3415 appliance.
ISE-1.3.xxx.xxx-virtual-SNS3495.ova—Use this template if your VMware appliance specification is comparable with an SNS-3495 appliance.
The following table provides OVA template reservations.
|
OVA Template |
Memory |
CPU |
||
|---|---|---|---|---|
|
Virtual Eval OVA |
4 GB RAM (no reservation)
|
2300 MHz (no reservation) |
||
|
Virtual SNS-3415 OVA |
16 GB RAM |
8000 MHz |
||
|
Virtual SNS-3495 OVA |
32 GB RAM |
16000 MHz |
To achieve performance and scalability comparable to the Cisco ISE hardware appliance, the VMware virtual machine should be allocated system resources equivalent to the Cisco SNS 3415 and 3495 appliances.
|
Requirement Type |
Specifications |
||||||
|---|---|---|---|---|---|---|---|
|
CPU |
Cisco ISE supports Hyperthreading. You can install ISE on VMware hosts that have the Hyperthreading option enabled or disabled.
|
||||||
|
Memory |
|
||||||
|
Hard Disks |
|
||||||
|
Storage and File System |
The storage system for the Cisco ISE virtual appliance requires a minimum write performance of 50 MB per second and a read performance of 300 MB per second. Deploy a storage system that meets these performance criteria and is supported by VMware server. Cisco ISE provides a number of methods to verify if your storage system meets these minimum requirements before, during, and after Cisco ISE installation. See Virtual Machine Resource and Performance Checks for more information. We recommend the VMFS file system because it is most extensively tested, but other file systems, transports, and media can also be deployed provided they meet the above requirements. |
||||||
|
Disk Controller |
Paravirtual (default for RHEL 6 64-bit) or LSI Logic Parallel For best performance and redundancy, a caching RAID controller is recommended. Controller options such as RAID 10 (also known as 1+0) can offer higher overall write performance and redundancy than RAID 5, for example. Additionally, battery-backed controller cache can significantly improve write operations. |
||||||
|
NIC |
1 GB NIC interface required (two or more NICs are recommended). Cisco ISE supports E1000 and VMXNET3 adapters.
|
||||||
|
VMware Virtual Hardware Version/Hypervisor |
|
||||||
Cisco ISE 2.4 introduces a large VM for Monitoring nodes. Deploying a Monitoring persona on a large VM offers the following advantages:
Improves performance in terms of faster response to live log queries and report completion.
Will be able to support the deployments that can handle more than 500, 000 sessions when the support is provided in future ISE releases.
Note |
This form factor is available only as a VM in Release 2.4 and later, and requires a large VM license. |
Keep the following guidelines in mind when allocating resources for the appliance:
Failure to allocate the specified resources might result in performance degradation or service failure. We highly recommend that you deploy dedicated VM resources and not share or oversubscribe resources across multiple guest VMs. Deploying Cisco ISE virtual appliances using the OVF templates ensures that adequate resources are assigned to each VM. If you do not use OVF templates, then ensure that you assign the equivalent resource reservations when you manually install Cisco ISE using the ISO image.
Note |
If you choose to deploy Cisco ISE manually without the recommended reservations, you must assume the responsibility to closely monitor your appliance’s resource utilization and increase resources, as needed, to ensure proper health and functioning of the Cisco ISE deployment. |
Note |
OVF templates are not applicable for Linux KVM. OVF templates are available only for VMware virtual machines. |
If you are using the OVA templates for installation, check the following settings after the installation is complete:
Ensure that the CPU usage in the CPU Limit field (under the Virtual Hardware tab in the Edit Settings window) is set to Unlimited. Setting a limit for CPU usage (for example, setting the CPU usage limit as 12000 MHz) will impact the system performance. If limit has been set, you must shutdown the VM client, remove the limit, and the restart the VM client.
Ensure that the memory usage in the Memory Limit field (under the Virtual Hardware tab in the Edit Settings window) is set to Unlimited. Setting a limit for memory usage (for example, setting the limit as 12000 MB) will impact the system performance.
Policy Service nodes on VMs can be deployed with less disk space than Administration or Monitoring nodes. The minimum disk space for any production Cisco ISE node is 200 GB. See Disk Space Requirements for details on the disk space required for various Cisco ISE nodes and personas.
VMs can be configured with 1 to 4 NICs. The recommendation is to allow for 2 or more NICs. Additional interfaces can be used to support various services such as profiling, guest services, or RADIUS.
|
Platform |
Small VM Appliance (based on SNS-3415) |
Large VM Appliance (based on SNS-3495) |
||||
|---|---|---|---|---|---|---|
|
Processor |
4 total cores (at 2.0 GHz or above)
|
8 total cores (at 2.0 GHz or above)
|
||||
|
Memory |
16 GB |
32 GB |
||||
|
Total Disk Space |
200 GB—1.999 TB. See Disk Space Requirements for more information. |
200 GB—1.999 TB. See Disk Space Requirements for more information. |
||||
|
Ethernet NICs |
Up to 4 Gigabit Ethernet NICs |
Up to 4 Gigabit Ethernet NICs |
The following table lists the Cisco ISE disk-space allocation recommended for running a virtual machine in a production deployment.
Note |
Disk size of 2 TB or greater is currently not supported. Ensure that the maximum disk size is less than 2 TB. |
|
ISE Persona |
Minimum Disk Space for Evaluation |
Minimum Disk Space for Production |
Recommended Disk Space for Production |
Maximum Disk Space |
|---|---|---|---|---|
|
Standalone ISE |
200 GB |
600 GB |
600 GB to 1.999 TB |
1.999 TB |
|
Distributed ISE—Administration only |
200 GB |
250 GB |
250 to 300 GB |
1.999 TB |
|
Distributed ISE—Monitoring only |
200 GB |
600 GB |
600 GB to 1.999 TB |
1.999 TB |
|
Distributed ISE—Policy Service only |
200 GB |
200 GB |
200 GB |
1.999 TB |
|
Distributed ISE—pxGrid only |
200 GB |
200 GB |
200 GB |
1.999 TB |
|
Distributed ISE—Administration and Monitoring (and optionally pxGrid) |
200 GB |
600 GB |
600 GB to 1.999 TB |
1.999 TB |
|
Distributed ISE—Administration, Monitoring, and Policy Service (and optionally pxGrid) |
200 GB |
600 GB |
600 GB to 1.999 TB |
1.999 TB |
Note |
Additional disk space is required to store local debug logs, staging files, and to handle log data during upgrade, when the Primary Administration Node temporarily becomes a Monitoring node. |
Keep the following guidelines in mind when deciding the disk space for Cisco ISE:
You can allocate only up to 1.999 TB of disk space for a Cisco ISE VM.
Cisco ISE must be installed on a single disk in virtual machine.
Disk allocation varies based on logging retention requirements. On any node that has the Monitoring persona enabled, 30 percent of the VM disk space is allocated for log storage. A deployment with 25,000 endpoints generates approximately 1 GB of logs per day.
For example, if you have a Monitoring node with 600-GB VM disk space, 180 GB is allocated for log storage. If 100,000 endpoints connect to this network every day, it generates approximately 4 GB of logs per day. In this case, you can store 38 days of logs in the Monitoring node, after which you must transfer the old data to a repository and purge it from the Monitoring database.
For extra log storage, you can increase the VM disk space. For every 100 GB of disk space that you add, you get 30 GB more for log storage. Depending on your requirements, you can increase the VM disk size up to a maximum of 1.999 TB of log storage.
If you increase the disk size of your virtual machine after initial installation, then you must perform a fresh installation of Cisco ISE on your virtual machine to properly detect and utilize the full disk allocation.
The following table lists the number of days that logs can be retained on your Monitoring node based on the allocated disk space and the number of endpoints that connect to your network. The numbers are based on having log suppression and anomalous client detection enabled.
|
No. of Endpoints |
200 GB |
600 GB |
1024 GB |
2048 GB |
|---|---|---|---|---|
|
10,000 |
126 |
378 |
645 |
1,289 |
|
20,000 |
63 |
189 |
323 |
645 |
|
30,000 |
42 |
126 |
215 |
430 |
|
40,000 |
32 |
95 |
162 |
323 |
|
50,000 |
26 |
76 |
129 |
258 |
|
100,000 |
13 |
38 |
65 |
129 |
|
150,000 |
9 |
26 |
43 |
86 |
|
200,000 |
7 |
19 |
33 |
65 |
|
250,000 |
6 |
16 |
26 |
52 |
If you find that context and visibility is slow, or you are running out of room for logs, you need to allocate more disk space.
To plan for additional log storage, for every 100 GB of disk space that you add, 60 GB is available for log storage. The maximum VM disk size is 1.999 TB .
In order for ISE to detect and utilize the new disk allocation, you must deregister the node, update the VM settings, and reinstall ISE. One way to do this is to install ISE on a new larger node, and add that node to the deployment as high availability. After the nodes have synchronized, make the new VM the primary and deregister the original VM.
Before installing Cisco ISE on a virtual machine, the installer performs hardware integrity checks by comparing the available hardware resources on the virtual machine with the recommended specifications.
During a VM resource check, the installer checks for the hard disk space, number of CPU cores allocated to the VM, CPU clock speed, and RAM allocated to the VM. If the VM resources do not meet the basic evaluation specifications, the installation aborts. This resource check is applicable only for ISO-based installations.
When you run the Setup program, a VM performance check is done, where the installer checks for disk I/O performance. If the disk I/O performance does not meet the recommended specifications, a warning appears on screen, but it allows you to continue with the installation. This performance verification check is applicable for both ISO-based and OVA (VMware) installations.
The VM performance check is done periodically (every hour) and the results are averaged for a day. If the disk I/O performance does not meet the recommended specification, an alarm is generated.
The VM performance check can also be done on demand from the Cisco ISE CLI using the show tech-support command.
The VM resource and performance checks can be run independent of Cisco ISE installation. You can perform this test from the Cisco ISE boot menu.
You can run the show tech-support command from the CLI to check the VM performance at any point of time. The output of this command will be similar to the following:
ise-vm123/admin# show tech | begin "disk IO perf"
Measuring disk IO performance
*****************************************
Average I/O bandwidth writing to disk device: 48 MB/second
Average I/O bandwidth reading from disk device: 193 MB/second
WARNING: VM I/O PERFORMANCE TESTS FAILED!
WARNING: The bandwidth writing to disk must be at least 50 MB/second,
WARNING: and bandwidth reading from disk must be at least 300 MB/second.
WARNING: This VM should not be used for production use until disk
WARNING: performance issue is addressed.
Disk I/O bandwidth filesystem test, writing 300 MB to /opt:
314572800 bytes (315 MB) copied, 7.81502 s, 40.3 MB/s
Disk I/O bandwidth filesystem read test, reading 300 MB from /opt:
314572800 bytes (315 MB) copied, 0.416897 s, 755 MB/s
You can check for virtual machine resources independent of Cisco ISE installation from the boot menu.
The CLI transcript appears as follows:
Welcome to the Cisco Identity Services Engine Installer
Cisco ISE Version: 1.3.0.299
Available boot options:
[1] Cisco ISE Installation (Keyboard/Monitor)
[2] Cisco ISE Installation (Serial Console)
[3] System Utilities (Keyboard/Monitor)
[4] System Utilities (Serial Console)
<Enter> Boot existing OS from hard disk.
Enter boot option and press <Enter>.
From the CLI boot menu, enter 3 or 4 to go to the System Utilities menu.
Cisco ISE System Utilities Menu
Available System Utilities:
[1] Recover administrator password
[2] Virtual Machine Resource Check
[3] System Erase
[4] Install Media Check
[q] Exit and reload
Enter option and press <Enter>
Enter 2 to check for VM resources. The output will be similar to the following:
*****
***** Virtual Machine host detected…
***** Hard disk(s) total size detected: 322 Gigabyte
***** Physical RAM size detected: 40443664 Kbytes
***** Number of network interfaces detected: 1
***** Number of CPU cores: 2
***** CPU Mhz: 2300.00
***** Verifying CPU requirement…
***** Verifying RAM requirement…
***** Writing disk partition table…
To obtain the Cisco ISE evaluation software (R-ISE-EVAL-K9=), contact your Cisco Account Team or your Authorized Cisco Channel Partner.
To migrate a Cisco ISE configuration from an evaluation system to a fully licensed production system, you need to complete the following tasks:
Back up the configuration of the evaluation version.
Ensure that your production VM has the required amount of disk space. See Deployment Size and Scaling Recommendations for details.
Install a production deployment license.
Restore the configuration to the production system.
Note |
For evaluation, the minimum allocation requirements for a hard disk on a VM is 200 GB. When you move the VM to a production environment that supports a larger number of users, be sure to reconfigure the Cisco ISE installation to the recommended minimum disk size or higher (up to the allowed maximum of 1.999 TB). |
For evaluation purposes, Cisco ISE can be installed on any supported VMs that complies with the VM requirements. When evaluating Cisco ISE, you can configure less disk space in the VM, but you must allocate a minimum disk space of 200 GB.
| Step 1 |
Go to http://www.cisco.com/go/ise. You must already have valid Cisco.com login credentials to access this link. |
| Step 2 |
Click . The software image comes with a 90-days evaluation license already installed, so you can begin evaluating all Cisco ISE services when the installation and initial configuration are complete. |
You can install Cisco ISE on VMs in any one of the following ways. We recommend that you download and deploy Cisco ISE OVA templates.
You can use OVA templates to install and deploy Cisco ISE software on a virtual machine. Download the OVA template from Cisco.com.
Note |
The ISE OVA templates are not compatible with VMware web client for vCenter 6.5. As a workaround, use the VMware OVF tool to import the OVA templates. You must reimage Cisco ISE from ISO if the virtual hard disk is resized after importing the OVA, as Cisco ISE does not support resizing hard disk and file systems after installation. |
| Step 1 |
Open VMware vSphere client. |
| Step 2 |
Log in to VMware host. |
| Step 3 |
Choose from the VMware vSphere Client. |
| Step 4 |
Click Browse to select the OVA template, and click Next. |
| Step 5 |
Confirm the details in the OVF Template Details page, and click Next. |
| Step 6 |
Enter a name for the virtual machine in the Name and Location page to uniquely identify it, and click Next. |
| Step 7 |
Choose a data store to host the OVA. |
| Step 8 |
Click the Thick Provision radio button in the Disk Format page, and click Next. Cisco ISE supports both thick and thin provisioning. However, we recommend that you choose thick provisioning for better performance, especially for Monitoring nodes. If you choose thin provisioning, operations such as upgrade, backup and restore, and debug logging that require more disk space might be impacted during initial disk expansion. |
| Step 9 |
Verify the information in the Ready to Complete page. Check the Power on after deployment check box. |
| Step 10 |
Click Finish. |
To install Cisco ISE on a VM using the ISO file:
Ensure that you read and allocate VM resources according to the requirements specified in this chapter.
Ensure that you have read the Prerequisites for Configuring a VMware ESX or ESXi Server section.
Download the Cisco ISE ISO image from Cisco.com.
| Step 1 |
Configure a VMware server. See Configure a VMware Server. |
| Step 2 |
Configure a VMware system to boot from a software DVD. See Configure a VMware System to Boot From a Cisco ISE Software DVD. |
| Step 3 |
Install Cisco ISE software on the VM. See Cisco ISE Setup Program Parameters |
Review the following configuration prerequisites listed in this section before you attempt to configure a VMWare ESX or ESXi server:
Remember to log in to the ESX or ESXi server as a user with administrative privileges (root user).
Cisco ISE is a 64-bit system. Before you install a 64-bit system, ensure that Virtualization Technology (VT) is enabled on the ESX or ESXi server. You must also ensure that your guest operating system type is set to Red Hat Enterprise Linux 6 (64-bit).
Note |
If you choose the default network driver (VMXNET3 ) as the Network Adapter, check the physical adapter mappings. Ensure that you map the Cisco ISE GigabitEthernet 0 interface to the 4th interface (NIC 4) in ESX or ESXi server. If you choose the E1000 Adapter, by default, the ESX or ESXi adapters and Cisco ISE adapters are mapped correctly. |
Ensure that you allocate the recommended amount of disk space on the VMware virtual machine. See the Disk Space Requirements section for more information.
If you have not created a VMware virtual machine file system (VMFS), you must create one to support the Cisco ISE virtual appliance. The VMFS is set for each of the storage volumes configured on the VMware host.
If you use VMFS5, the 1-MB block size supports up to 1.999 TB virtual disk size.
If you use VMFS3, you must choose a VMFS block size based on the largest virtual-disk size hosted on the VMware host. After you configure the VMFS block size, you cannot change it without reformatting the VMFS partitions. For VMFS3, the VMFS block size should be based on the size of the largest virtual disk:
|
Block Size |
Virtual Disk Size |
|---|---|
|
1 MB |
256 GB |
|
2 MB |
512 GB |
|
4 MB |
1 TB |
|
8 MB |
1.999 TB |
If you have an ESX or ESXi server installed already, you can check if VT is enabled on it without rebooting the machine. To do this, use the esxcfg-info command. Here is an example:
~ # esxcfg-info |grep "HV Support"
|----HV Support............................................3
|----World Command Line.................................grep HV Support
If HV Support has a value of 3, then VT is enabled on the ESX or ESXi server and you can proceed with the installation.
If HV Support has a value of 2, then VT is supported, but not enabled on the ESX or ESXi server. You must edit the BIOS settings and enable VT on the ESX or server.
You can reuse the same hardware that you used for hosting a previous version of Cisco ISE virtual machine. However, before you install the latest release, you must enable Virtualization Technology (VT) on the ESX or ESXi server.
| Step 1 |
Reboot the SNS-3400 series appliance. |
| Step 2 |
Press F2 to enter setup. |
| Step 3 |
Choose . |
| Step 4 |
Select Intel(R) VT and enable it. |
| Step 5 |
Press F10 to save your changes and exit. |
Configure VMware server interfaces to support the collection of Switch Port Analyzer (SPAN) or mirrored traffic to a dedicated probe interface for the Cisco ISE Profiler Service.
| Step 1 |
Choose (the name of your VMware server instance)VMswitch0 (one of your VMware ESX or ESXi server interfaces) Properties Security. |
| Step 2 |
In the Policy Exceptions pane on the Security tab, check the Promiscuous Mode check box. |
| Step 3 |
In the Promiscuous Mode drop-down list, choose Accept and click OK. Repeat the same steps on the other VMware ESX or ESXi server interface used for profiler data collection of SPAN or mirrored traffic. |
| Step 1 |
Power down the particular VMware server (for example ISE-120). |
| Step 2 |
Right-click the VMware server and choose Edit. |
| Step 3 |
Click Add on the Hardware tab. |
| Step 4 |
Choose Serial Port and click Next. |
| Step 5 |
In the Serial Port Output area, click the Use physical serial port on the host or the Connect via Network radio button and click Next.
|
| Step 6 |
Click Next. |
| Step 7 |
In the Device Status area, check the appropriate check box. The default is Connected. |
| Step 8 |
Click OK to connect to the VMware server. |
Ensure that you have read the details in the Prerequisites for Configuring a VMware ESX or ESXi Server section.
| Step 1 |
Log in to the ESX or ESXi server. |
||
| Step 2 |
In the VMware vSphere Client, in the left pane, right-click your host container and choose New Virtual Machine. |
||
| Step 3 |
In the Configuration dialog box, choose Custom for the VMware configuration and click Next. |
||
| Step 4 |
Enter a name for the VMware system and click Next.
|
||
| Step 5 |
Choose a datastore that has the recommended amount of space available and click Next. |
||
| Step 6 |
(Optional) If your VM host or cluster supports more than one VMware virtual machine version, choose a Virtual Machine version such as Virtual Machine Version 7, and click Next. |
||
| Step 7 |
Choose Linux and Red Hat Enterprise Linux 6 (64-bit) from the Version drop-down list. |
||
| Step 8 |
Choose 2 from the Number of virtual sockets and the Number of cores per virtual socket drop-down list. Total number of cores should be 4. (Optional; appears in some versions of ESX or ESXi server. If you see only the Number of virtual processors, choose 4). |
||
| Step 9 |
Choose the amount of memory and click Next. |
||
| Step 10 |
Choose the E1000 NIC driver from the Adapter drop-down list and click Next.
|
||
| Step 11 |
Choose Paravirtual as the SCSI controller and click Next. |
||
| Step 12 |
Choose Create a new virtual disk and click Next. |
||
| Step 13 |
In the Disk Provisioning dialog box, click Thick Provision radio button, and click Next to continue. Cisco ISE supports both thick and thin provisioning. However, we recommend that you choose thick provisioning for better performance, especially for Monitoring nodes. If you choose thin provisioning, operations such as upgrade, backup and restore, and debug logging that require more disk space might be impacted during initial disk expansion. |
||
| Step 14 |
Uncheck the Support clustering features such as Fault Tolerance check box. |
||
| Step 15 |
Choose the advanced options, and click Next. |
||
| Step 16 |
Verify the configuration details, such as Name, Guest OS, CPUs, Memory, and Disk Size of the newly created VMware system. You must see the following values:
For the Cisco ISE installation to be successful on a virtual machine, ensure that you adhere to the recommendations given in this document. |
||
| Step 17 |
Click Finish. The VMware system is now installed. |
To activate the newly created VMware system, right-click VM in the left pane of your VMware client user interface and choose Power > Power On.
On a VMware virtual machine, the boot delay by default is set to 0. You can change this boot delay to help you choose the boot options (while resetting the Administrator password, for example).
| Step 1 |
From the VSphere client, right click the VM and choose Edit Settings. |
| Step 2 |
Click the Options tab. |
| Step 3 |
Choose Advanced > Boot Options. |
| Step 4 |
From the Power on Boot Delay area, select the time in milliseconds to delay the boot operation. |
| Step 5 |
Check the check box in the Force BIOS Setup area to enter into the BIOS setup screen when the VM boots the next time. |
| Step 6 |
Click OK to save your changes. |
After configuring the VMware system, you are ready to install the Cisco ISE software. To install the Cisco ISE software from a DVD, you need to configure the VMware system to boot from it. This requires the VMware system to be configured with a virtual DVD drive.
You must download the Cisco ISE ISO, burn the ISO image on a DVD, and use it to install Cisco ISE on the virtual machine.
| Step 1 |
In the VMware client, highlight the newly created VMware system and choose Edit Virtual Machine Settings. |
| Step 2 |
In the Virtual Machine Properties dialog box, choose CD/DVD Drive 1. |
| Step 3 |
Click the Host Device radio button and choose the DVD host device from the drop-down list. |
| Step 4 |
Choose the Connect at Power On option and click OK to save your settings. You can now use the DVD drive of the VMware ESX or ESXi server to install the Cisco ISE software. |
After you complete this task, click the Console tab in the VMware client user interface, right-click VM in the left pane, choose Power, and choose Reset to restart the VMware system.
After installation, if you do not install a permanent license, Cisco ISE automatically installs a 90-day evaluation license that supports a maximum of 100 endpoints.
Download the Cisco ISE software from the Cisco Software Download Site at http://www.cisco.com/en/US/products/ps11640/index.html and burn it on a DVD. You will be required to provide your Cisco.com credentials.
| Step 1 |
Log in to the VMware client. |
| Step 2 |
For the virtual machine to enter the BIOS setup mode, right click the VM and click Edit Settings. |
| Step 3 |
Click the Options tab. |
| Step 4 |
Select Boot Options and configure the following option:
|
| Step 5 |
Click OK. |
| Step 6 |
Ensure that the Coordinated Universal Time (UTC) and the correct boot order is set in BIOS: |
| Step 7 |
Insert the Cisco ISE software DVD into the VMware ESX or ESXi host CD/DVD drive and turn on the virtual machine. When the DVD boots, the console displays: |
| Step 8 |
At the system prompt:
|
| Step 9 |
At the system prompt, type setup and press Enter. |
If a fresh installation of Cisco ISE on a virtual machine fails, and you have the default network driver (VMXNET3 ) chosen as the Network Adapter, check the physical adapter mappings. Ensure that you map the Cisco ISE GigabitEthernet 0 interface to the 4th interface (NIC 4) in ESX or ESXi. The workaround is to use the E1000 driver as the Network Adapter.
You can clone a Cisco ISE VMware virtual machine (VM) to create an exact replica of a Cisco ISE node. For example, in a distributed deployment with multiple Policy Service nodes (PSNs), VM cloning helps you deploy the PSNs quickly and effectively. You do not have to install and configure the PSNs individually.
You can also clone a Cisco ISE VM using a template.
Note |
For cloning, you need VMware vCenter. Cloning must be done before you run the Setup program. |
Ensure that you shut down the Cisco ISE VM that you are going to clone. In the vSphere client, right-click the Cisco ISE VM that you are about to clone and choose .
Ensure that you change the IP Address and Hostname of the cloned machine before you power it on and connect it to the network.
| Step 1 |
Log in to the ESX or ESXi server as a user with administrative privileges (root user). VMware vCenter is required to perform this step. |
| Step 2 |
Right-click the Cisco ISE VM you want to clone, and click Clone. |
| Step 3 |
Enter a name for the new machine that you are creating in the Name and Location dialog box and click Next. This is not the hostname of the new Cisco ISE VM that you are creating, but a descriptive name for your reference. |
| Step 4 |
Select a Host or Cluster on which you want to run the new Cisco ISE VM and click Next. |
| Step 5 |
Select a datastore for the new Cisco ISE VM that you are creating and click Next. This datastore could be the local datastore on the ESX or ESXi server or a remote storage. Ensure that the datastore has enough disk space. |
| Step 6 |
Click the Same format as source radio button in the Disk Format dialog box and click Next. This option copies the same format that is used in the Cisco ISE VM that you are cloning this new machine from. |
| Step 7 |
Click the Do not customize radio button in the Guest Customization dialog box and click Next. |
| Step 8 |
Click Finish. |
If you are using vCenter, then you can use a VMware template to clone a Cisco ISE virtual machine (VM). You can clone the Cisco ISE node to a template and use that template to create multiple new Cisco ISE nodes. Cloning a virtual machine using a template is a two-step process:
Note |
For cloning, you need VMware vCenter. Cloning must be done before you run the Setup program. |
| Step 1 | |
| Step 2 |
Ensure that you shut down the Cisco ISE VM that you are going to clone. In the vSphere client, right-click the Cisco ISE VM that you are about to clone and choose Power > Shut Down Guest.
We recommend that you create a template from a Cisco ISE VM that you have just installed and not run the setup program on. You can then run the setup program on each of the individual Cisco ISE nodes that you have created and configure IP address and hostnames individually.
| Step 1 |
Log in to the ESX or ESXi server as a user with administrative privileges (root user). VMware vCenter is required to perform this step. |
| Step 2 |
Right-click the Cisco ISE VM that you want to clone and choose . |
| Step 3 |
Enter a name for the template, choose a location to save the template in the Name and Location dialog box, and click Next. |
| Step 4 |
Choose the ESX or ESXi host that you want to store the template on and click Next. |
| Step 5 |
Choose the datastore that you want to use to store the template and click Next. Ensure that this datastore has the required amount of disk space. |
| Step 6 |
Click the Same format as source radio button in the Disk Format dialog box and click Next. The Ready to Complete dialog box appears. |
| Step 7 |
Click Finish. |
After you create a virtual machine template, you can deploy it on other virtual machines (VMs).
| Step 1 |
Right-click the Cisco ISE VM template that you have created and choose Deploy Virtual Machine from this template. |
| Step 2 |
Enter a name for the new Cisco ISE node, choose a location for the node in the Name and Location dialog box, and click Next. |
| Step 3 |
Choose the ESX or ESXi host where you want to store the new Cisco ISE node and click Next. |
| Step 4 |
Choose the datastore that you want to use for the new Cisco ISE node and click Next. Ensure that this datastore has the required amount of disk space. |
| Step 5 |
Click the Same format as source radio button in the Disk Format dialog box and click Next. |
| Step 6 |
Click the Do not customize radio button in the Guest Customization dialog box. The Ready to Complete dialog box appears. |
| Step 7 |
Check the Edit Virtual Hardware check box and click Continue. The Virtual Machine Properties page appears. |
| Step 8 |
Choose Network adapter, uncheck the Connected and Connect at power on check boxes, and click OK. |
| Step 9 |
Click Finish. You can now power on this Cisco ISE node, configure the IP address and hostname, and connect it to the network. |
After you clone a Cisco ISE virtual machine (VM), you have to power it on and change the IP address and hostname.
Ensure that the Cisco ISE node is in the standalone state.
Ensure that the network adapter on the newly cloned Cisco ISE VM is not connected when you power on the machine. Uncheck the Connected and Connect at power on check boxes. Otherwise, if this node comes up, it will have the same IP address as the source machine from which it was cloned.
Ensure that you have the IP address and hostname that you are going to configure for the newly cloned VM as soon as you power on the machine. This IP address and hostname entry should be in the DNS server. You cannot use "localhost" as the hostname for a node.
Ensure that you have certificates for the Cisco ISE nodes based on the new IP address or hostname.
Procedure| Step 1 |
Right-click the newly cloned Cisco ISE VM and choose. |
| Step 2 |
Select the newly cloned Cisco ISE VM and click the Console tab. |
| Step 3 |
Enter the following commands on the Cisco ISE CLI: The hostname is the new hostname that you are going to configure. The Cisco ISE services are restarted. |
| Step 4 |
Enter the following commands: The ip_address is the address that corresponds to the hostname that you entered in step 3 and netmask is the subnet mask of the ip_address. The system will prompt you to restart the Cisco ISE services. See the Cisco Identity Services Engine CLI Reference Guide, for the ip address and hostname commands. |
| Step 5 |
Enter Y to restart Cisco ISE services. |
After you power on and change the ip address and hostname, you must connect the Cisco ISE node to the network.
| Step 1 |
Right-click the newly cloned Cisco ISE virtual machine (VM) and click Edit Settings. |
| Step 2 |
Click Network adapter in the Virtual Machine Properties dialog box. |
| Step 3 |
In the Device Status area, check the Connected and Connect at power on check boxes. |
| Step 4 |
Click OK. |
After evaluating the Cisco ISE release, you can migrate the from an evaluation system to a fully licensed production system.
When you move the VMware server to a production environment that supports a larger number of users, be sure to reconfigure the Cisco ISE installation to the recommended minimum disk size or higher (up to the allowed maximum of 1.999 TB).
Please not that you cannot migrate data to a production VM from a VM created with less than 200 GB of disk space. You can only migrate data from VMs created with 200 GB or more disk space to a production environment.
| Step 1 |
Back up the configuration of the evaluation version. |
| Step 2 |
Ensure that your production VM has the required amount of disk space. |
| Step 3 |
Install a production deployment license. |
| Step 4 |
Restore the configuration to the production system. |
Feedback