Cisco Identity Services Engine Hardware Installation Guide, Release 2.0

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Identity Services Engine Hardware Installation Guide, Release 2.0

Chapter Title

Post-Installation and Maintenance Tasks

Results

Updated:
January 28, 2020

Chapter: Post-Installation and Maintenance Tasks

Post-Installation and Maintenance Tasks

Log In to the Cisco ISE Web-Based Interface

When you log in to the Cisco ISE web-based interface for the first time, you will be using the preinstalled Evaluation license.


Note
We recommend that you use the Cisco ISE user interface to periodically reset your administrator login password.

Caution

For security reasons, we recommend that you log out when you complete your administrative session. If you do not log out, the Cisco ISE web-based web interface logs you out after 30 minutes of inactivity, and does not save any unsubmitted configuration data.

Before you begin

The Cisco ISE Admin portal supports the following browsers for the Admin Portal:

  • Mozilla Firefox 62 and earlier versions

  • Google Chrome 69 and earlier versions

  • Microsoft Internet Explorer 9.x, 10.x and 11.x

    If you are using Internet Explorer 10.x, enable TLS 1.1 and TLS 1.2, and disable SSL 3.0 and TLS 1.0 (Internet Options > Advanced).


Note

Adobe Flash Player 11.1.0.0 or above must be installed on the system running the client browser. The minimum required screen resolution to view the Cisco ISE GUI is 1280 x 800 pixels.

Procedure

Step 1

After the Cisco ISE appliance reboot has completed, launch one of the supported web browsers.

Step 2

In the Address field, enter the IP address (or hostname) of the Cisco ISE appliance by using the following format and press Enter. 


https://<IP address or host name>/admin/
Step 3

Enter a username and password that you defined during setup.

Step 4

Click Login.

Cisco ISE Configuration Verification

There are two methods that each use a different set of username and password credentials for verifying Cisco ISE configuration by using a web browser and CLI.


Note

A CLI-admin user and a web-based admin user credentials are different in Cisco ISE.

Verify Configuration Using a Web Browser

Procedure

Step 1

After the Cisco ISE appliance reboot has completed, launch one of the supported web browsers.

Step 2

In the Address field, enter the IP address (or host name) of the Cisco ISE appliance using the following format and press Enter.

Step 3

In the Cisco ISE Login page, enter the username and password that you have defined during setup and click Login.

For example, entering https://10.10.10.10/admin/ displays the Cisco ISE Login page. 

https://<IP address or host name>/admin/
Note 
For first-time web-based access to Cisco ISE system, the administrator username and password is the same as the CLI-based access that you configured during setup.
Step 4

Use the Cisco ISE dashboard to verify that the appliance is working correctly.

What to do next

By using the Cisco ISE web-based user interface menus and options, you can configure the Cisco ISE system to suit your needs. For details on configuring Cisco ISE, see Cisco Identity Services Engine Administrator Guide.

Verify Configuration Using the CLI

Before you begin

To get the latest Cisco ISE patches and keep Cisco ISE up-to-date, visit the following web site: http://www.cisco.com/public/sw-center/index.shtml

Procedure

Step 1

After the Cisco ISE appliance reboot has completed, launch a supported product, such as PuTTY, for establishing a Secure Shell (SSH) connection to a Cisco ISE appliance.

Step 2

In the Host Name (or IP Address) field, enter the hostname (or the IP address in dotted decimal format of the Cisco ISE appliance) and click Open.

Step 3

At the login prompt, enter the CLI-admin username (admin is the default) that you configured during setup and press Enter.

Step 4

At the password prompt, enter the CLI-admin password that you configured during setup (this is user-defined and there is no default) and press Enter.

Step 5

At the system prompt, enter show application version ise and press Enter.

Note 
The Version field lists the currently installed version of Cisco ISE software.

The console output appears as shown below: 

ise-vm123/admin# show application version ise

Cisco Identity Services Engine
---------------------------------------------
Version      : 1.3.0.6391.4.0.205
Build Date   : Sun May 25 19:31:27 2014Tue Mar  3 19:31:27 2015
Install Date : Sun May 25 21:06:31 2014Tue Mar  3 21:06:31 2015
Step 6

To check the status of the Cisco ISE processes, enter show application status ise and press Enter.

The console output appears as shown below: 

ise-server/admin# show application status ise 

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
Database Listener                      running          3638        
Database Server                        running          45 PROCESSES
Application Server                     running          5992        
Profiler Database                      running          4483        
AD Connector                           running          6401        
M&T Session Database                   running          2313        
M&T Log Collector                      running          6247        
M&T Log Processor                      running          6274        
Certificate Authority Service          running          6213        
pxGrid Infrastructure Service          disabled                     
pxGrid Publisher Subscriber Service    disabled                     
pxGrid Connection Manager              disabled                     
pxGrid Controller                      disabled                     
Identity Mapping Service               disabled

VMware Tools Installation Verification

Verify VMWare Tools Installation Using the Summary Tab in the vSphere Client

Go to the Summary tab of the specified VMware host in the vShpere Client. The value in the VMware Tools field should be OK.

Figure 1. Verifying VMware Tools in the vSphere Client

Verify VMWare Tools Installation Using the CLI

You can also verify if the VMware tools are installed using the show inventory command. This command lists the NIC driver information. On a virtual machine with VMware tools installed, VMware Virtual Ethernet driver will be listed in the Driver Descr field. 
vm36/admin# show inventory
NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis"
PID: ISE-VM-K9, VID: V01 , SN: 8JDCBLIDLJA
Total RAM Memory: 4016564 kB
CPU Core Count: 1
CPU 0: Model Info: Intel(R) Xeon(R) CPU E5504 @ 2.00GHz
Hard Disk Count(*): 1
Disk 0: Device Name: /dev/sda
Disk 0: Capacity: 64.40 GB
Disk 0: Geometry: 255 heads 63 sectors/track 7832 cylinders
NIC Count: 1
NIC 0: Device Name: eth0
NIC 0: HW Address: 00:0C:29:BA:C7:82
NIC 0: Driver Descr: VMware Virtual Ethernet driver
(*) Hard Disk Count may be Logical.
vm36/admin#

NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis"
PID: ISE-VM-K9       , VID: A0  , SN: FCH184X9XXX
Total RAM Memory: 65700380 kB
CPU Core Count: 16
CPU 0: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 1: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 2: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 3: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 4: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 5: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 6: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 7: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 8: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 9: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 10: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 11: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 12: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 13: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 14: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
CPU 15: Model Info: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz
Hard Disk Count(*): 1
Disk 0: Device Name: /xxx/abc
Disk 0: Capacity: 1198.00 GB
NIC Count: 6
NIC 0: Device Name: eth0:
NIC 0: HW Address: xx:xx:xx:xx:xx:xx
NIC 0: Driver Descr: Intel(R) Gigabit Ethernet Network Driver
NIC 1: Device Name: eth1:
NIC 1: HW Address: xx:xx:xx:xx:xx:xx
NIC 1: Driver Descr: Intel(R) Gigabit Ethernet Network Driver
NIC 2: Device Name: eth2:
NIC 2: HW Address: xx:xx:xx:xx:xx:xx
NIC 2: Driver Descr: Intel(R) Gigabit Ethernet Network Driver
NIC 3: Device Name: eth3:
NIC 3: HW Address: xx:xx:xx:xx:xx:xx
NIC 3: Driver Descr: Intel(R) Gigabit Ethernet Network Driver
NIC 4: Device Name: eth4:
NIC 4: HW Address: xx:xx:xx:xx:xx:xx
NIC 4: Driver Descr: Intel(R) Gigabit Ethernet Network Driver
NIC 5: Device Name: eth5:
NIC 5: HW Address: xx:xx:xx:xx:xx:xx
NIC 5: Driver Descr: Intel(R) Gigabit Ethernet Network Driver

(*) Hard Disk Count may be Logical.

Support for Upgrading VMware Tools

The Cisco ISE ISO image (regular, upgrade, or patch) contains the supported VMware tools. Upgrading VMware tools through the VMware client user interface is not supported with Cisco ISE. If you want to upgrade any VMware tools to a higher version, support is provided through a newer version of Cisco ISE (regular, upgrade, or patch release).

Return Material Authorization

In case of a Return Material Authorization (RMA), if you are replacing individual components on an SNS server, be sure to reimage the appliance before you install Cisco ISE. Contact Cisco TAC for assistance.

Reset a Disabled Password Due to Administrator Lockout

An administrator can enter an incorrect password enough times to disable the account. The minimum and default number of attempts is five.

Use these instructions to reset the administrator user interface password with the application reset-passwd ise command in the Cisco ISE CLI. It does not affect the CLI password of the administrator. After you successfully reset the administrator password, the credentials are immediately active and you can log in without having to reboot the system. .

Cisco ISE adds a log entry in the Monitor > Reports > Catalog > Server Instance > Server Instance > Server Administrator Logins report, and suspends the credentials for that administrator ID until you reset the password associated with that administrator ID.

Procedure

Step 1

Access the direct-console CLI and enter:

application reset-passwd ise administrator_ID

Step 2

Specify and confirm a new password that is different from the previous two passwords that were used for this administrator ID: 


Enter new password:
Confirm new password:

Password reset successfully

Change the IP Address of a Cisco ISE Appliance

Before you begin

  • Ensure that the Cisco ISE node is in a standalone state before you change the IP address. If the node is part of a distributed deployment, deregister the node from the deployment and make it a standalone node.

  • Do not use the no ip address command when you change the Cisco ISE appliance IP address.

Procedure

Step 1

Log in to the Cisco ISE CLI.

Step 2

Enter the following commands:

  1. configure terminal

  2. interface GigabitEthernet 0

  3. ip address new_ip_address new_subnet_mask

    The system prompts you for the IP address change. Enter Y . A screen similar to the following one appears. 

ise-13-infra-2/admin(config-GigabitEthernet)# ip address a.b.c.d 255.255.255.0

% Changing the IP address might cause ISE services to restart
Continue with IP address change? Y/N [N]: y
Stopping ISE Monitoring & Troubleshooting Log Collector...
Stopping ISE Monitoring & Troubleshooting Log Processor...
Stopping ISE Identity Mapping Service...
Stopping ISE pxGrid processes...
Stopping ISE Application Server...
Stopping ISE Certificate Authority Service...
Stopping ISE Profiler Database...
Stopping ISE Monitoring & Troubleshooting Session Database...
Stopping ISE AD Connector...
Stopping ISE Database processes...
Starting ISE Monitoring & Troubleshooting Session Database...
Starting ISE Profiler Database...
Starting ISE pxGrid processes...
Starting ISE Application Server...
Starting ISE Certificate Authority Service...
Starting ISE Monitoring & Troubleshooting Log Processor...
Starting ISE Monitoring & Troubleshooting Log Collector...
Starting ISE Identity Mapping Service...
Starting ISE AD Connector...
Note: ISE Processes are initializing. Use 'show application status ise'
CLI to verify all processes are in running state.

Cisco ISE prompts you to restart the system.

Step 3

Enter Y to restart the system.

View Installation and Upgrade History

Cisco ISE provides a Command Line Interface (CLI) command to view the details of installation, upgrade, and uninstallation of Cisco ISE releases and patches. The show version history command provides the following details:

  • Date—Date and time at which the installation or uninstallation was performed

  • Application—Cisco ISE application

  • Version—Version that was installed or removed.

  • Action—Installation, Uninstallation, Patch Installation, or Patch Uninstallation

  • Bundle Filename—Name of the bundle that was installed or removed

  • Repository—Repository from which the Cisco ISE application bundle was installed. Not applicable for uninstallation.

Procedure

Step 1

Log in to the Cisco ISE CLI.

Step 2

Enter the following command: show version history.

The following output appears: 

Positron/admin# Show version history
---------------------------------------------
Install Date: Thu Mar 20 22:01:16 PDT 2014Tue Mar 03 20:25:58 UTC 2015
Application: ise
Version: 1.3.0.5681.4.0.205
Install type: Application Install
Bundle filename: ise.tar.gz
Repository: SystemDefaultPkgRepos

Configure RAID on SNS-3415 Appliance

On the SNS-3415 appliance, you must manually configure the Redundant Array of Independent Disks (RAID) before installing Cisco ISE.

Procedure

Step 1

Press Ctrl + Alt + Del to reboot the appliance.

Step 2

Press Ctrl+M to enter the LSI Software RAID Configuration menu.

Step 3

From the Management menu, select Configure.

Step 4

Select Clear Configuration and confirm your selection.

Step 5

Select Easy Configuration.

A box with READY label appears.

Step 6

Press the space bar to select that volume.

The label changes to ONLIN A00-xx.

Step 7

Press F10 to configure the volume and press the space bar to select the array.

Step 8

Press F10 to configure the array.

A box appears specifying the volume data including the size (557.8 GB) and RAID 0.

Step 9

Use the arrow keys to navigate to Accept and press Enter.

Step 10

Press the Escape key and save the configuration.

Step 11

Press the Escape key thrice to exit all menus.

You will be prompted to reboot the appliance.

Step 12

Reboot the appliance.

Step 13

After you install Cisco ISE and reboot the appliance, press F6 to enter in to the Boot Order menu.

Step 14

Select Embedded SCU RAID to boot from the hard disk.

Configure RAID on SNS-3495 Appliance Using CIMC

You must configure the Redundant Array of Independent Disks (RAID) using CIMC, before installing Cisco ISE.

Before you begin

You must have configured CIMC before you can configure the RAID on the SNS-3495 appliance. Refer to Configure Cisco Integrated Management Controller

Procedure

Step 1

In the CIMC user interface, choose Server > BIOS > Configure BIOS Parameter.

Step 2

Click the Advanced tab. In the Onboard Storage area, set the Onboard SCU Storage Support option to Enabled.

Step 3

Click Save Changes. The following message appears: 

Reboot Host Immediately option is not selected. BIOS settings will be applied only on next host reboot. Continue?
Step 4

Click Yes.

Step 5

Choose Server > Summary > Power Cycle Server.

Step 6

Click OK.

Step 7

Choose Server > Summary > Launch KVM Console.

The console screen of the kernal-based virtual machine (KVM) appears.

Step 8

Choose Server > Summary > Power Cycle Server.

Step 9

During bootup, press Ctrl+H to access the WebBIOS.

Step 10

In the KVM WebBIOS, click Start.

Step 11

In the BIOS Config Utility Physical Configuration pane, click Configuration Wizard.

Step 12

Click Add Configuration, and then click Next.

Step 13

Click Automatic Configuration.

Step 14

In the Redundancy drop-down list, select the Redundancy When Possible option, and then click Next.

Step 15

Click Yes to save the configuration.

Step 16

Click Yes to initialize the new virtual drive.

Step 17

Click Set Boot Drive, and then click Go.

Step 18

Click Home.

Step 19

Click Exit.

Step 20

Click Yes.

Step 21

Reboot the server.

Step 22

Choose Inventory > Storage > Virtual Drive Info. Ensure that the newly added virtual drive is listed in the Virtual Drive info tab.

Perform a System Erase

You can perform a system erase to securely erase all information from your Cisco ISE appliance or VM. This option to perform a system erase ensures that Cisco ISE is compliant with the NIST Special Publication 800-88 data destruction standards.

Before you begin

Make sure you understand the following connection-related conditions that can cause a problem when attempting to use the Cisco ISE Software DVD to start up a Cisco ISE appliance:

  • You have a terminal server associated with the serial console connection to the Cisco ISE appliance that is set to exec. Setting it to no exec allows you to use a KVM connection and a serial console connection.

  • You have a keyboard and video monitor (KVM) connection to the Cisco ISE appliance (this can be either a remote KVM or a VMware vSphere client console connection).

  • You have a serial console connection to the Cisco ISE appliance.

Procedure

Step 1

Ensure that the Cisco ISE appliance is powered up.

Step 2

Insert the Cisco ISE Software DVD.

For example, the Cisco ISE 3415 console displays the following message: 
Welcome to the Cisco Identity Services Engine Installer
     Cisco ISE Version: 1.3.0.2991.4.0.205

Available boot options:

  [1] Cisco ISE Installation (Keyboard/Monitor)
  [2] Cisco ISE Installation (Serial Console)
  [3] System Utilities (Keyboard/Monitor)
  [4] System Utilities (Serial Console)
  <Enter> Boot existing OS from hard disk.

Enter boot option and press <Enter>.
Step 3

At the system prompt, enter 3 if you use a keyboard and video monitor connection to the appliance, or enter 4 if you use a local serial console port connection.

The system displays the ISO utilities menu as shown below. 

     Cisco ISE System Utilities Menu

Available System Utilities:

  [1] Recover administrator password
  [2] Virtual Machine Resource Check
  [3] System Erase
  [4] Install Media Check
  [q] Exit and reload

Enter option and press <Enter>
Step 4

Enter 3 to perform a system erase.

The console displays: 

                 **********   W A R N I N G   **********
YOU ARE ABOUT TO PERFORM A SYSTEM ERASE. THIS ACTION WILL DELETE ALL 
CONTENT OF THE HARD DISK BY WRITING A SEQUENCE OF RANDOM BYTES, FOLLOWED
BY ZEROS DIRECTLY TO THE HARD DISK DEVICE.

ARE YOU SURE YOU WANT TO PROCEED? [Y/N] Y
Step 5

Enter Y.

The console prompts you with another warning: 

THIS IS YOUR LAST CHANGE TO ABORT. PROCEED WITH SYSTEM ERASE? [Y/N] Y
Step 6

Enter Y to perform a system erase.

The console displays: 

Deleting system disk, please wait…
Writing random data to all sectors of disk device (/dev/sda)…
Writing zeros to all sectors of disk device (/dev/sda)…
Completed!  System is now erased.  
Press <Enter> to reboot.

After you perform a system erase, if you want to reuse the appliance, you must boot the system using the Cisco ISE DVD and choose the install option from the boot menu.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco