Cisco Identity Services Engine Installation Guide, Release 3.5

PDF

CPU requirements for hypervisors

Updated: May 28, 2026

Want to summarize with AI?

Log in

Overview

Lists the minimum CPU architecture requirements and instruction set extensions needed for Cisco ISE 3.4 and 3.5 hypervisor deployments, as well as affected services and configuration guidance.

From Cisco ISE release 3.4, several Cisco ISE services run inside containers based on RHEL 9.3. RHEL 9.3 requires a minimum CPU architecture of x86-64-v2. From Cisco ISE release 3.5, the TC-NAC service uses MongoDB 5.0, which requires Advanced Vector Extensions (AVX) support.

If your hypervisor presents a CPU baseline below x86-64-v2 to the guest VM, the affected containers fail to start. The Cisco ISE GUI and CLI show these processes as not running or initializing:

  • Processes that require x86-64-v2 (Cisco ISE release 3.4 and later)

    • ISE pxGrid Direct Service

    • ISE pxGrid Direct Pusher

    • Hermes (pxGrid Cloud Agent)

    • McTrust (Meraki Sync Service)

    • ACI Connector

    • MFC Profiler

  • Processes that require AVX (Cisco ISE release 3.5 and later)

    • TC-NAC MongoDB Container

    • TC-NAC Core Engine Container

To verify whether your hypervisor exposes the required CPU flags, run these commands from the Cisco ISE CLI admin or root shell:

To verify AVX support, use this command:

show tech-support | include avx

To verify x86-64-v2 support (including SSE4.2 and POPCNT), use this command:

show tech-support | include sse4_2

If the output is empty, the hypervisor is masking the required CPU features, which prevents affected services from starting.

If the output includes these flags, your VM detects the modern CPU instruction sets exposed by the hypervisor. For example, if sse4_2 and popcnt are present, the guest VM receives the x86-64-v2 instruction set from the hypervisor. This instruction set is required for RHEL 9-based ISE containers. If avx is present, the guest VM receives AVX support, which satisfies MongoDB's AVX requirement.

If these strings are missing, your hypervisor masks the CPU features required by Cisco ISE.

If the physical CPU supports these instruction sets, you can enable or expose them to the VM using these hypervisor-specific settings:

  • ESXi: Enable Expose hardware-assisted virtualization to the guest OS.

  • Hyper-V: Disable Migrate to a physical computer with a different processor version. Migration to another physical host remains supported if the CPU vendor and processor generation are the same.

  • KVM, Proxmox, or Nutanix: Change the CPU type from default to host.