Install Cisco ISE

Install Cisco ISE Using CIMC

Use these high-level steps to install Cisco ISE quickly.

Before you begin

Procedure

Step 1

If you are installing Cisco ISE on a:

  • Cisco SNS appliance: Install the hardware appliance. Connect to CIMC for server management.

  • Virtual Machine: Ensure that your VM is configured correctly.

Step 2

Download the Cisco ISE ISO image.

  1. Go to http://www.cisco.com/go/ise. You must already have valid Cisco.com login credentials to access this link.

  2. Click Download Software for this Product.

    The Cisco ISE image comes with a 90-day evaluation license already installed. You can begin testing all Cisco ISE services after you complete installation and initial configuration.

Step 3

Boot the appliance or the virtual machine.

  • Cisco SNS appliance:

    1. Connect to CIMC and log in using the CIMC credentials.

    2. Launch the KVM console.

    3. Select Virtual Media > Activate Virtual Devices.

    4. Select Virtual Media > Map CD/DVD and select the ISE ISO image and click Map Device.

    5. From Macros > Static Macros > Ctrl-Alt-Del to boot the appliance with the ISE ISO image.

    6. Press F6 to open the boot menu. A similar screen appears:

      Figure 1. Selection of Boot Device
      Selection of boot device for Cisco ISE installation

      Note

       

      • If the SNS appliances are in a remote location, such as a data center, and you do not have physical access, installation through CIMC from remote servers might take many hours. To speed up the installation process in a remote location, copy the ISO file to a USB drive and use it during installation.

      • ISE installation using CIMC may be affected by network speed, network stability, TCP segmentation, or other operating system factors. This may affect the installation time (approximately 30 minutes or 0.5 hours) for Cisco ISE.

  • Virtual Machine:

    1. Map the CD/DVD to an ISO image. A similar screen appears. The installation menu appears with the message.

      Welcome to the Cisco Identity Services Engine Installer
Cisco ISE Version: 3.2.0.xxx


Available boot options:

Cisco ISE Installation (Serial Console)
Cisco ISE Installation (Keyboard/Monitor)
System Utilities (Serial Console)
System Utilities (Keyboard/Monitor)

Step 4

At the boot prompt, press 1 and Enter to install Cisco ISE using a serial console.

If you want to use a keyboard and monitor, use the arrow key to select the Cisco ISE Installation (Keyboard/Monitor) option. The message appears. 

**********************************************
Please type 'setup' to configure the appliance
**********************************************

Step 5

At the prompt, type setup to start the Setup program. See Run the Setup Program of Cisco ISE for details about the parameters that the Setup program uses.

Step 6

After you enter the network configuration parameters in the Setup mode, the appliance automatically reboots, and returns to the shell prompt mode.

Step 7

Exit shell prompt mode. The appliance starts up.

Step 8

Proceed to Verifying the Cisco ISE Installation Process .

Installation Metrics for Cisco ISE

Table 1. Latency and Installation Metrics for Cisco ISE

Mount Type

Time Taken for Installation

Approximate Latency

NFS-CIMC Mount

7 hours

Average round-trip time < 1 millisecond

CD or DVD - KVM Mount

4 hours

-

USB

1 hour

-

Run the Setup Program of Cisco ISE

This section explains how to configure the ISE server.

The setup program launches an interactive command-line interface (CLI) that prompts for required parameters. Use the console or a dumb terminal to configure initial network settings and provide administrator credentials for the ISE server. This setup process is a one-time-configuration task.


Note

If you are integrating with Active Directory (AD), it is best to use the IP and subnet addresses from a dedicated site created specifically for Cisco ISE. Consult the AD staff in your organization to retrieve the relevant IP and subnet addresses for your ISE nodes before installation and configuration.


Note

It is not recommended to attempt offline installation of Cisco ISE as this can lead to system instability. If you run the installation script offline, this error appears:

Sync with NTP server failed' Incorrect time could render the system unusable until it is re-installed. Retry? Y/N [Y]:

Select Yes to continue with the installation.

Select No to try syncing with the NTP server.

It is recommended to establish network connectivity with both the NTP server and the DNS server while running the installation script.

To run the setup program:

Procedure

Step 1

Turn on the appliance designated for the installation.

The Setup prompt appears: 

Type 'setup' to configure the appliance
localhost login:

Step 2

At the login prompt, enter setup and press Enter.

The console displays a set of parameters. You must enter the parameter values for each prompt in the table.

Note

 

The eth0 interface of Cisco ISE must be statically configured with an IPv6 address if you want to add a Domain Name Server or an NTP Server with an IPv6 address.

Table 2. Cisco ISE Setup Program Parameters

Prompt

Description

Example

Hostname

  • Must not exceed characters 19

  • Length: Must not exceed 19 characters

  • Valid characters: Alphanumeric (A–Z, a–z, 0–9) and hyphen

  • The first character must be a letter

Note

 

We recommend that you use lowercase letters to ensure that certificate authentication in Cisco ISE is not impacted by minor differences in certificate-driven verifications. Do not use "localhost" as hostname for a node.

isebeta1

(eth0) Ethernet interface address

Address must be a valid IPv4 or Global IPv6 for the Gigabit Ethernet 0 (eth0) interface.

10.12.13.14/ 2001:420:54ff:4::458:121:119

Netmask

Must be a valid IPv4 or IPv6 netmask.

255.255.255.0/ 2001:420:54ff:4::458:121:119/122

Default gateway

Must be a valid IPv4 or Global IPv6 address for the default gateway.

10.12.13.1/ 2001:420:54ff:4::458:1

DNS domain name

Cannot be an IP address. Valid characters include ASCII characters, any numerals, the hyphen (-), and the period (.).

example.com

Primary name server

Must be a valid IPv4 or Global IPv6 address for the primary name server.

10.15.20.25 / 2001:420:54ff:4::458:118

Add/Edit another name server

Must be a valid IPv4 or Global IPv6 address for the primary name server.

(Optional) Allows you to configure multiple name servers. To configure multiple name servers, enter y to continue.

Primary NTP server

Must be a valid IPv4 or Global IPv6 address or hostname of a Network Time Protocol (NTP) server.

Note

 

Ensure that the primary NTP server is reachable.

clock.nist.gov / 10.15.20.25 / 2001:420:54ff:4::458:117

Add/Edit another NTP server

Must be a valid NTP domain.

(Optional) Allows you to configure multiple NTP servers. To do so, enter y to continue.

System Time Zone

Must be a valid time zone. For example, for Pacific Standard Time (PST), the System Time Zone is PST8PDT, or Coordinated Universal Time (UTC) minus 8 hours (UTC–08:00).

Note

 

Ensure that the system time and time zone match with the CIMC or Hypervisor Host OS time and time zone. System performance might be affected if there is any mismatch between the time zones.

Note

 

Set all Cisco ISE nodes to the UTC time zone. This setting ensures that reports, logs, and posture agent log files from the nodes in your deployment are always synchronized by timestamp.

UTC (default)

Username

Identifies the administrative username used for CLI access to the Cisco ISE system. If you choose not to use the default (admin), you must create a new username. The Username must be 3 to 8 characters in length and consist of valid alphanumeric characters (A–Z, a–z, or 0–9).

admin (default)

Password

Identifies the administrative password that is used for CLI access to the Cisco ISE system. You must create this password in order to continue because there is no default password. The password must be a minimum of six characters in length and include at least one lowercase letter (a–z), one uppercase letter (A–Z), and one numeral (0–9).

MyIseYPass2

Note

 

When you create a password for the administrator during installation or after installation in the CLI, do not use the $ character in your password, unless it is the last character of the password. If it is the first or one of the subsequent characters, the password is accepted, but cannot be used to log in to the CLI.

If you create such a password by mistake, reset your password by logging into the console and using the CLI command, or by using an ISE CD or ISO file. See this document for instructions on resetting your password using an ISO file: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200568-ISE-Password-Recovery-Mechanisms.html

After you run the setup program, the system reboots automatically.

Now, log in to Cisco ISE using the username and password you configured during the setup process.

Verifying the Cisco ISE Installation Process

To verify that you have correctly completed the installation process:

Procedure

Step 1

When the system reboots and the login prompt appears, enter the username you configured during setup. Then press Enter.

Step 2

Enter a new password.

Step 3

To verify that the application has been installed properly, enter the show application command. Then press Enter.

The console displays: 
ise/admin# show application
<name>          <Description> 
ise             Cisco Identity Services Engine

Note

 

The version and date might change for different versions of this release.

Step 4

To check the status of the ISE processes, enter the show application status ise command, and press Enter.

The console displays: 
ise/admin# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
Database Listener                      running          14890       
Database Server                        running          70 PROCESSES
Application Server                     running          19158       
Profiler Database                      running          16293       
ISE Indexing Engine                    running          20773       
AD Connector                           running          22466       
M&T Session Database                   running          16195       
M&T Log Collector                      running          19294       
M&T Log Processor                      running          19207       
Certificate Authority Service          running          22237       
EST Service                            running          29847       
SXP Engine Service                     disabled                     
Docker Daemon                          running          21197       
TC-NAC Service                         disabled        
pxGrid Infrastructure Service          disabled                     
pxGrid Publisher Subscriber Service    disabled                     
pxGrid Connection Manager              disabled                     
pxGrid Controller                      disabled                     
PassiveID WMI Service                  disabled                     
PassiveID Syslog Service               disabled                     
PassiveID API Service                  disabled                     
PassiveID Agent Service                disabled                     
PassiveID Endpoint Service             disabled                     
PassiveID SPAN Service                 disabled                     
DHCP Server (dhcpd)                    disabled                     
DNS Server (named)                     disabled                     

ise/admin#

Install Cisco ISE on a Cisco SNS Appliance Using NFS

This section describes how to install Cisco ISE on a Cisco SNS appliance using a Network File System (NFS) server.

Before you begin

Procedure

Step 1

Download the Cisco ISE ISO image from http://www.cisco.com/go/ise.

Step 2

Connect to CIMC and log in using the CIMC credentials.

Step 3

Choose Compute > Remote Management > Virtual Media > Add New Mapping.

Step 4

In the Add New Mapping window, enter the details of the NFS server and then click Save.

Step 5

In the Current Mappings window, ensure that the Status of the added mapping is shown as OK.

Step 6

Launch the KVM console.

Step 7

Choose Power > Power Cycle System.

Step 8

Click Confirm.

Step 9

Press F6 to enter the boot menu.

Step 10

In the Select Boot Device window, choose UEFI: Cisco CIMC-Mapped vDVD2.00, and press Enter.

After the server completes the booting process, the Cisco ISE installation menu appears.

Step 11

Choose Cisco ISE Installation (Keyboard/Monitor) to continue with the installation.

Localized ISE Installation

While reinstalling Cisco ISE, you can use the Localized ISE Install option in the application configure ise command to reduce the installation time. By using this option, you can reduce the reinstallation time from an average of 5 to 7 hours to approximately 1 to 2 hours. Although this option can be used for both Secure Network Servers (SNS) and virtual appliances, it significantly reduces the reinstallation time for Secure Network Servers.


Note

  • Localized ISE Install option is supported for Cisco ISE 3.1 Patch 9 and later, Cisco ISE 3.2 Patch 5 and later, Cisco ISE 3.3 Patch 2 and later, and Cisco ISE 3.4 and later releases.

  • You can use this option to reinstall the current version and higher versions. You cannot install a version that is older than the current version.

For more information, see "Localized ISE Installation" in the Chapter "Cisco ISE CLI Commands in EXEC Mode" in the Cisco Identity Services Engine CLI Reference Guide.