ISE에서 컨피그레이션 및 운영 데이터 백업 내보내기

참고: ISE 컨피그레이션 백업에는 시스템 및 신뢰할 수 있는 인증서가 포함되며 내부 CA(Certificate Authority) 인증서는 포함되지 않습니다.

내부 CA(Certificate Authority) 저장소를 ISE CLI에서 수동으로 백업하려면 SSH를 통해 ISE PAN(Primary Admin Node) 노드에 로그인하고 애플리케이션 구성 ise > 옵션 7을 선택하여 내부 CA 저장소를 내보냅니다.

ise/admin# application configure ise

Selection configuration option
[1]Reset M&T Session Database
[2]Rebuild M&T Unusable Indexes
[3]Purge M&T Operational Data
[4]Reset M&T Database
[5]Refresh Database Statistics
[6]Display Profiler Statistics
[7]Export Internal CA Store
[8]Import Internal CA Store
[9]Create Missing Config Indexes
[10]Create Missing M&T Indexes
[11]Enable/Disable ACS Migration
[12]Generate Daily KPM Stats
[13]Generate KPM Stats for last 8 Weeks
[14]Enable/Disable Counter Attribute Collection
[15]View Admin Users
[16]Get all Endpoints
[17]Enable/Disable Wifi Setup
[18]Reset Config Wifi Setup
[19]Establish Trust with controller
[20]Reset Context Visibility
[21]Synchronize Context Visibility With Database
[22]Generate Heap Dump
[23]Generate Thread Dump
[24]Force Backup Cancellation
[25]CleanUp ESR 5921 IOS Crash Info Files
[0]Exit

7
Export Repository Name: FTP-Repo
Enter encryption-key for export: 
Security Protocol list Start
Inside Session facade init
Old Memory Size : 7906192
Old Memory Size : 7906192
Export in progress...
Old Memory Size : 7906192

The next 5 CA key pairs were exported to repository 'FTP-Repo' at 'ise_ca_key_pairs_of_ise':
        Subject:CN=Certificate Services Root CA - ise
        Issuer:CN=Certificate Services Root CA - ise
        Serial#:0x08f06033-2a4c4fcc-b297e75a-04f11bf9

        Subject:CN=Certificate Services Node CA - ise
        Issuer:CN=Certificate Services Root CA - ise
        Serial#:0x3a0e8d8a-5a2846be-a902c280-b5d678aa

        Subject:CN=Certificate Services Endpoint Sub CA - ise
        Issuer:CN=Certificate Services Node CA - ise
        Serial#:0x33b14150-596c4552-ad0a9ab1-9541f0bb

        Subject:CN=Certificate Services Endpoint RA - ise
        Issuer:CN=Certificate Services Endpoint Sub CA - ise
        Serial#:0x37e17494-cf1d4372-bf0ba1e6-83653826

        Subject:CN=Certificate Services OCSP Responder - ise
        Issuer:CN=Certificate Services Node CA - ise
        Serial#:0x68a694ed-bc48481d-bc6cc58e-60a44a61

ise CA keys export completed successfully 

CLI에서 온디맨드 ISE 컨피그레이션 데이터 백업 수행

1단계. 저장소 구성: ISE에서 저장소 구성 방법 참조

2단계. PAN 노드의 CLI에 로그인하고 다음 명령을 실행합니다.

 백업 <백업 파일 이름> 저장소 <저장소 이름> ise-config encryption-key plain <암호화 키>

ise/admin# backup ConfigBackup-CLI repository FTP-Repo ise-config encryption-key plain <backup password>
% Internal CA Store is not included in this backup. It is recommended to export it using "application configure ise" CLI command 
% Creating backup with timestamped filename: ConfigBackup-CLI-CFG10-200326-0705.tar.gpg 
% backup in progress: Starting Backup...10% completed 
% backup in progress: Validating ISE Node Role...15% completed
% backup in progress: Backing up ISE Configuration Data...20% completed
% backup in progress: Backing up ISE Indexing Engine Data...45% completed
% backup in progress: Backing up ISE Logs...50% completed
% backup in progress: Completing ISE Backup Staging...55% completed
% backup in progress: Backing up ADEOS configuration...55% completed 
% backup in progress: Moving Backup file to the repository...75% completed 
% backup in progress: Completing Backup...100% completed 
ise/admin# 

GUI에서 온디맨드 ISE 운영 데이터 백업 수행

1단계. 저장소 구성: ISE에서 저장소 구성 방법 참조

2단계. ISE 운영 백업을 시작합니다.

ISE GUI에 로그인하고, Administration(관리) > System(시스템) > Backup & Restore(백업 및 복원)로 이동하여 Operational Data Backup(운영 데이터 백업)을 선택하고 Backup Now(지금 백업)를 클릭합니다.

3단계. Backup Name(백업 이름), Repository Name(리포지토리 이름) 및 Encryption Key(암호화 키)를 제공하고 Backup(백업)을 클릭합니다.

팁: 암호화 키를 기억해야 합니다.

CLI에서 온디맨드 ISE 운영 데이터 백업 수행

1단계.저장소 구성: ISE에서 저장소 구성 방법 참조

2단계. 기본 MNT 노드의 CLI에 로그인하고 다음 명령을 실행합니다.

backup <backup file name> repository <repository name> ise 운영 암호화 키 plain <encryption key>

ise/admin# backup Ops-Backup-CLI repository FTP-Repo ise-operational encryption-key plain <backup password>
% Creating backup with timestamped filename: Ops-Backup-CLI-OPS10-200326-0719.tar.gpg
% backup in progress: Starting Backup...10% completed
% backup in progress: starting dbbackup using expdp.......20% completed
% backup in progress: starting cars logic.......50% completed
% backup in progress: Moving Backup file to the repository...75% completed
% backup in progress: Completing Backup...100% completed
ise/admin# 

다음을 확인합니다.

그림과 같이 Administration > System > Backup & Restore로 이동하여 Configuration Data Backup 진행률을 확인합니다.

그림과 같이 운영 데이터 백업 진행률을 검토하려면 Administration > System > Backup & Restore로 이동합니다.

PAN 노드의 CLI에서 컨피그레이션 백업의 진행 상황을 확인할 수도 있습니다.

ise/admin# show backup status 
%% Configuration backup status
%% ----------------------------
%      backup name: ConfigBackup-CLI
%       repository: FTP-Repo
%       start date: Thu Mar 26 07:05:11 IST 2020
%        scheduled: no
%   triggered from: CLI
%             host: 
%           status: Backup is in progress
%       progress %: 50
% progress message: Backing up ISE Logs

%% Operation backup status
%% ------------------------
%  No data found. Try 'show backup history' or ISE operation audit report
ise/admin# 

백업이 완료되면 백업 상태를 성공으로 볼 수 있습니다.

문제 해결

ISE 인덱싱 엔진 서비스가 ISE 관리 노드에서 실행 중인지 확인합니다.

ise-1/admin# show application status ise

ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
Database Listener                      running          15706       
Database Server                        running          89 PROCESSES
Application Server                     running          25683       
Profiler Database                      running          23511       
ISE Indexing Engine                    running          28268       
AD Connector                           running          32319       
M&T Session Database                   running          23320       
M&T Log Processor                      running          16272       

ISE에서 백업 복원을 디버깅하려면 다음 디버그를 사용합니다.

ise-1/admin# debug backup-restore backup ?
  <0-7>  Set level, from 0 (severe only) to 7 (all)
  <cr>   Carriage return.

ise-1/pan# debug backup-restore backup 7
ise-1/pan#
ise-1/pan# 6 [25683]:[info] backup-restore:backup: br_history.c[549] [system]: ISE backup/restore initiated by web UI as ise.br.status is 'in-progress' in /tmp/ise-cfg-br-flags
7 [25683]:[debug] backup-restore:backup: br_backup.c[600] [system]: initiating backup Config-Backup to repos FTP-Repo
7 [25683]:[debug] backup-restore:backup: br_backup.c[644] [system]: no staging url defined, using local space
7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area
7 [25683]:[debug] backup-restore:backup: br_backup.c[673] [system]: creating /opt/backup/backup-Config-Backup-1587431770
7 [25683]:[debug] backup-restore:backup: br_backup.c[677] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/cars
7 [25683]:[debug] backup-restore:backup: br_backup.c[740] [system]: creating /opt/backup/backup-Config-Backup-1587431770/backup/ise
7 [25683]:[debug] backup-restore:backup: br_backup.c[781] [system]: calling script /opt/CSCOcpm/bin/isecfgbackup.sh
6 [25683]:[info] backup-restore:backup: br_backup.c[818] [system]: adding ADEOS files to backup
6 [25683]:[info] backup-restore:backup: br_backup.c[831] [system]: Backup password provided by user
6 [25683]:[info] backup-restore:backup: br_backup.c[190] [system]: No post-backup entry in the manifest file for ise
7 [25683]:[debug] backup-restore:backup: br_backup.c[60] [system]: flushing the staging area
6 [25683]:[info] backup-restore:backup: br_backup.c[912] [system]: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success
6 [25683]:[info] backup-restore:backup: br_history.c[487] [system]: updating /tmp/ise-cfg-br-flags with status: complete and message: backup Config-Backup-CFG10-200421-0646.tar.gpg to repository FTP-Repo: success

노드에서 디버그를 비활성화하려면 no debug backup-restore backup 7을 사용합니다.

ise-1/admin# no debug backup-restore backup 7