Install Cisco ISE using Cisco Integrated Management Interface

Updated: September 18, 2026

Want to summarize with AI?

Provides detailed instructions for installing Cisco ISE on both SNS hardware appliances and virtual machines. It covers system requirements, Cisco IMC setup for appliance management, VM configuration including VMware OVA templates, ISO image download and boot procedures, management interface configuration, and Zero Touch Provisioning for automated installations.

Use these high-level steps to install Cisco ISE.

Before you begin

Verify that your system meets the System Requirements.
For virtual machine installations, create the VM according to the specified configuration. Refer to these topics for more information.
For SNS hardware appliances, set up Cisco Integrated Management Interface (Cisco IMC) to manage the appliance and configure BIOS. Refer to the respective hardware installation guides:
- SNS-3600 Series: Cisco SNS-3600 Series Appliance Hardware Installation Guide
- SNS-3700 Series: Cisco SNS-3700 Series Appliance Hardware Installation Guide
- SNS-3800 Series: Cisco SNS-3800 Series Appliance Hardware Installation Guide

Procedure

Installation Overview
- For Cisco SNS Appliances
  1. Install the hardware appliance.
  2. Connect to Cisco IMC for server management.
- For Virtual Machines
  1. Confirm your VM configuration matches the requirements.
Download Software: Download the Cisco ISE ISO image.
1. Go to http://www.cisco.com/go/ise. You need valid Cisco.com login credentials to access the site.
2. Click Download Software for this Product.
  
  The Cisco ISE image includes a pre-installed 90-day evaluation license, which enables you to test all Cisco ISE services after completing installation and initial configuration.
Booting the appliance or VM
- Cisco SNS appliance:
  1. Connect to Cisco IMC and log in using the Cisco IMC credentials.
  2. Launch the KVM console.
  3. Select Virtual Media > Activate Virtual Devices.
  4. Select Virtual Media > Map CD/DVD, select the Cisco ISE ISO image, and click Map Device.
  5. Select Macros > Static Macros > Ctrl-Alt-Del to boot the appliance with the Cisco ISE ISO image.
  6. Press F6 to open the boot menu. A similar screen appears:
    
    Figure 1. Selection of boot device
    
    Note
    
    For remote SNS appliances without physical access, installation through Cisco IMC may take several hours. To speed up installation, copy the ISO file to a USB drive and use it during installation.
    
    Installation time may vary (approximately 30 minutes) depending on network speed, stability, TCP segmentation, and operating system factors.
    
    If the system enters an emergency shell during initial boot due to incomplete hardware initialization, reboot to allow initialization to complete and continue installation.
- Virtual Machine:
  1. Map the CD/DVD to an ISO image. A similar screen appears. The installation menu appears with the message.
```
Welcome to the Cisco Identity Services Engine Installer
Cisco ISE Version: 3.x.x.xxx


Available boot options:

Cisco ISE Installation (Serial Console)
Cisco ISE Installation (Keyboard/Monitor)
System Utilities (Serial Console)
System Utilities (Keyboard/Monitor)
```
At the boot prompt, press 1 and Enter to install Cisco ISE using a serial console.
If you want to use a keyboard and monitor, use the arrow key to select the Cisco ISE Installation (Keyboard/Monitor) option. The message appears.
```
**********************************************
Please type 'setup' to configure the appliance
**********************************************
```
Setup program: At the prompt, type setup to start the setup program. See Run the setup program of Cisco ISE for details about the parameters that the setup program uses.
After you enter the network configuration parameters in the setup mode, the appliance automatically reboots, and returns to the shell prompt mode.
Exit shell prompt mode. The appliance starts.
Proceed to Verify the Cisco ISE installation process.

Troubleshooting

Issue: Shim SBAT security-policy error while installing older Cisco ISE release on appliance

When installing an older Cisco ISE release on a physical appliance that previously ran a newer release, this Shim SBAT security-policy error may be displayed while booting the installation media:

Verifying shim SBAT data failed: Security Policy Violation
Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation

For example, if you attempt a fresh installation of Cisco ISE release 3.3 on an appliance running Cisco ISE release 3.4 or later, this error may appear during boot.

This issue can occur with any supported installation method, including USB, NFS, CD, DVD, or others.

Solution: If you encounter this error, follow these steps:

Reinstall the applicable BIOS on the appliance.
Activate the reinstalled BIOS.
Prepare the installation media for the target, older Cisco ISE release.
Reboot the appliance and open the boot-selection menu.
Select and boot directly from the target installation media.

Do not allow the appliance to boot from the existing installed Cisco ISE image after activating the BIOS.
Complete the fresh installation of the target Cisco ISE release.

You must boot directly from the target installation media after reinstalling and activating the BIOS. If the appliance boots into the existing ISE installation instead, this error may recur when attempting to boot the older installation media.

Installation metrics for Cisco ISE

The table outlines the installation duration and network latency metrics for various mount types for Cisco ISE.

Table 1. Latency and installation metrics for Cisco ISE
Mount type	Time taken for installation	Approximate latency
NFS-CIMC Mount	7 hours	Average round-trip time is less than 1 millisecond
CD or DVD - KVM Mount	4 hours	-
USB	1 hour	-

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.