在ISE上安裝修補程式

簡介

本文檔介紹在安裝期間安裝ISE補丁和常見問題的方法。

必要條件

需求

身份服務引擎(ISE)的基本知識。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

• 思科身分識別服務引擎3.X

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

背景資訊

思科會以半定期的方式發布 ISE。這些修補程式包含錯誤修復，並在必要時包含安全修復（例如，通過SSL發現的Heartbleed和Poodle漏洞）。這可確保應用錯誤修復、插入安全漏洞以及解決方案無縫工作。

當您在ISE節點上安裝補丁時，該節點將重新啟動。安裝完成後重新啟動服務。請等待幾分鐘，然後您就可以重新登入了。

您可以在維護時段期間安排修補程式安裝作業，以避免暫時中斷的情況。

僅安裝適用於網路中部署的思科版本的修補程式。思科會報告版本中的任何不符情況以及修補檔案中的任何錯誤。

您不能安裝低於當前在思科上安裝的補丁的版本。同樣地，如果思科產品上已安裝較新的版本，您便無法復原較舊版本的變更。

當您從屬於分散式部署的主管理節點(PAN)安裝補丁時，思科ISE在主節點上安裝補丁程式，然後在部署中的所有輔助節點上安裝補丁程式。如果在PAN上成功安裝補丁程式，思科ISE則繼續在輔助節點上安裝補丁程式。如果PAN上的安裝失敗，則安裝不會繼續到輔助節點。但是，如果由於任何原因在任何輔助節點上安裝失敗，它仍會繼續進行部署中的下一個輔助節點。

當您從屬於雙節點部署的PAN安裝補丁時，思科會在主節點上安裝該補丁，然後在輔助節點上安裝該補丁。

如果在PAN上成功安裝了補丁程式，則思科將在輔助節點上繼續安裝補丁程式。如果在PAN上失敗，安裝不會繼續到輔助節點。

您必須具有超級管理員或系統管理員的管理員角色，才能安裝或復原修補程式。在修補程式安裝開始之前，收集配置備份和操作備份。

使用GUI安裝補丁程式

要從Cisco.com下載ISE補丁程式，請導航到下載>產品>安全>訪問控制和策略>身份服務引擎>身份服務引擎軟體(此處)。

附註：思科ISE修補程式通常是累積的，這意味著修補程式11的安裝包括從修補程式1到修補程式10的所有修補程式。修補程式安裝需要重新啟動ISE伺服器。

附註：下載修補程式檔案後驗證MD5/SHA512校驗和。

要在ISE上應用補丁程式，請登入到ISE主管理節點(PAN)GUI並執行以下說明： 

步驟1.導航到管理>System >維護>補丁程式管理>安裝.

步驟2.按一下Browse，然後選擇從Cisco.com下載的修補檔案。

步驟 3. 按一下「安裝」以安裝修補程式。

使用CLI安裝修補程式

步驟 1. 設定 ISE 存放庫並將所需的 ISE 修補程式放置在存放庫中。若要設定 ISE 存放庫，請參閱如何在 ISE 上設定存放庫。

步驟2.使用SSH登入ISE CLI。

步驟 3. 確認 ISE CLI 可以列出存放庫內容。

ise1/admin# show repository FTP_repository

ise-patchbundle-3.3.0.430-Patch2-24041511.SPA.x86_64.tar.gz
ise-patchbundle-3.3.0.430-Patch3-24070910.SPA.x86_64.tar.gz
ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz

步驟4.要從CLI在特定ISE節點上安裝補丁程式，請在執行模式下運行命令 patch install。

patch install  

透過 SSH 登入 ISE 節點的 CLI，然後執行下列命令：

ise1/admin# patch install ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz FTP_repository
% Warning: Patch will be installed only on this node. Install using Primary Administration node GUI to install on all nodes in deployment. Continue? (yes/no) [yes] ? yes
Initiating Application Patch installation...

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
Patch successfully installed

Broadcast message from root@ISE (pts/3) (Tue Dec 17 09:36:52 2024):

Trying to stop processes gracefully. Reload might take approximately 3 mins


% This application Install or Upgrade requires reboot, rebooting now...

Broadcast message from root@ISE (pts/3) (Tue Dec 17 09:37:21 2024):

The system is going down for reboot NOW

在部署中的所有ISE節點上安裝補丁程式

當您從屬於分散式部署的PAN安裝補丁時，思科ISE在主節點上安裝補丁程式，然後在部署中的所有輔助節點上安裝補丁程式。如果在主PAN上成功安裝補丁程式，思科ISE則繼續在輔助節點上安裝補丁程式。如果PAN上的安裝失敗，則安裝不會繼續到輔助節點。

但是，如果出於任何原因而在任何次要節點上安裝失敗，則仍會繼續在部署中的下一個次要節點上進行安裝。

在部署中的所有ISE節點上回滾補丁程式

若要從部署中的 Cisco ISE 節點復原修補程式，您必須先透過 PAN 復原變更。如果成功完成此動作，則修補程式將會從次要節點復原。如果PAN上的回滾流程失敗，則不會從輔助節點回滾補丁程式。但是，如果在任何輔助節點上回滾補丁程式失敗，它仍會繼續從部署中的下一個輔助節點回滾補丁程式。

當Cisco ISE從輔助節點回滾補丁時，您可以繼續從PAN GUI執行其他任務。輔助節點在回滾後重新啟動。

要回滾ISE修補程式，請登入到ISE GUI，然後導航到Administration > System > Maintenance > Patch Management，然後選擇所需的修補程式並按一下Rollback，如下所示：

從ISE CLI回滾補丁程式

步驟 1。 使用 SSH 前往您要移除修補程式的 ISE 節點。

步驟2.使用show version 命令驗證ISE節點上安裝的修補程式：

ise1/admin# show version

Cisco Application Deployment Engine OS Release: 3.3
ADE-OS Build Version: 3.3.P.097
ADE-OS System Architecture: x86_64

Copyright (c) 2005-2023 by Cisco Systems, Inc.
All rights reserved.
Hostname: ise-aaa-dnac1


Version information of installed applications
---------------------------------------------

Cisco Identity Services Engine
---------------------------------------------
Version : 3.3.0.430
Build Date : Tue Jul 4 00:31:18 2023
Install Date : Sat Nov 9 22:42:47 2024

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 1
Install Date : Tue Dec 17 09:57:23 2024

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 4
Install Date : Tue Dec 17 11:49:53 2024

步驟3.運行patch remove <application name> <patch file number to be removed>命令。

            例如，patch remove ise 4:

ise1/admin# patch remove ise 4
Continue with application patch uninstall? [y/n] y
% Warning: Patch is removed only from this node. Remove patch with Primary Administration node GUI to remove from all nodes in deployment.

Patch successfully uninstalled

% This application Install or Upgrade requires reboot, rebooting now...
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:16:29 2020):
Trying to stop processes gracefully. Reload takes approximately 3 mins
Broadcast message from root@ISE (pts/1) (Sun Mar 8  03:16:29 2020):
Trying to stop processes gracefully. Reload takes approximately 3 mins
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:17:41 2020):
The system is going down for reboot NOW
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:17:41 2020):
The system is going down for reboot NOW

附註：ISE修補程式實際上是累積的，當存在較新版本時無法回滾。較新的版本需要首先回滾。

  要解除安裝以前的修補程式，請先解除安裝最新的修補程式，然後解除安裝以前的修補程式版本。

ise1/admin#patch remove ise 1
Continue with application patch uninstall? [y/n] y
% Warning: Patch is removed only from this node. Remove patch with Primary Administration node GUI to remove from all nodes in deployment. 
Continue? (yes/no) [yes] ? yes
% Patch cannot be rolled back while a newer version exists, which needs to rolled back first. 

驗證

若要檢視ISE修補程式的安裝進度，請導覽至Administration > System > Maintenance > Patch Management > Show Node Status，如下圖所示：

從ISE節點驗證修補程式安裝狀態。登入到同一ISE伺服器並運行show version命令：

ise1/admin# show version

Cisco Application Deployment Engine OS Release: 3.3
ADE-OS Build Version: 3.3.P.097
ADE-OS System Architecture: x86_64

Copyright (c) 2005-2023 by Cisco Systems, Inc.
All rights reserved.
Hostname: ise-aaa-dnac1


Version information of installed applications
---------------------------------------------

Cisco Identity Services Engine
---------------------------------------------
Version : 3.3.0.430
Build Date : Tue Jul 4 00:31:18 2023
Install Date : Sat Nov 9 22:42:47 2024

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 4
Install Date : Tue Dec 17 11:49:53 2024

驗證ISE警報中的成功和失敗修補程式消息：

修補程式安裝成功記錄參考

ise1/admin# sh logging system ade/ADE.log tail
2024-12-17T09:28:29.162564+00:00 ise1 CARSSetup[2783958]: ADEAUDIT 2030, type=PATCH INSTALL, name=PATCH INSTALL STARTED, username=system, cause=Application patch install has been inititated, adminipaddress=127.0.0.1, interface=CLI, detail=Patch Install initiated with bundle - ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz, repo - SFTP-REPO
2024-12-17T09:28:29.104724+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] user: cars_install.c[5641] [system]: Illegal characters or double dots not found in name ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz
2024-12-17T09:28:29.105444+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] user: cars_install.c[5641] [system]: Illegal characters or double dots not found in name SFTP-REPO
2024-12-17T09:28:29.162700+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2568] [system]: Install initiated with bundle - ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz, repo - SFTP-REPO
2024-12-17T09:28:29.171681+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2734] [system]: Stage area - /storeddata/Installing/.1734427709
2024-12-17T09:28:29.193007+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2737] [system]: Getting bundle to local machine
2024-12-17T09:28:29.193704+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] transfer: cars_xfer.c[159] [system]: sftp copy in of ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz requested
2024-12-17T09:28:29.194062+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] transfer: cars_xfer_util.c[2643] [system]: Server validation successful x.x.x.x
2024-12-17T09:28:29.194784+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] transfer: sftp_handler.c[689] [system]: DEBUG: local user: admin UID: 0 sftp_run_parent FD: 9 remote host: x.x.x.x remote user: admin command: get /ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz /storeddata/Installing/.1734427709/ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz
2024-12-17T09:29:24.127455+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] transfer: cars_xfer_util.c[2666] [system]: Properties file /tmp/.cars_repodownload.props does not exist
2024-12-17T09:29:24.127573+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2794] [system]: Got bundle at - /storeddata/Installing/.1734427709/ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz
2024-12-17T09:29:24.156171+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2867] [system]: Unbundling package ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz
2024-12-17T09:29:41.327286+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2969] [system]: Verifying signature for package ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz
2024-12-17T09:29:51.072928+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[2993] [system]: Signed bundle /storeddata/Installing/.1734427709/ise-patchbundle-3.3.0.430-Patch4-24102504.SPA.x86_64.tar.gz confirmed with release key
2024-12-17T09:30:09.180007+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[3172] [system]: Unbundling done. Verifying input parameters...
2024-12-17T09:30:09.180604+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[3214] [system]: Manifest file is at - /storeddata/Installing/.1734427709/manifest.xml
2024-12-17T09:30:09.180652+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[3283] [system]: Manifest file appname - ise
2024-12-17T09:30:09.180953+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[3388] [system]: Patch bundle contains patch(4) for app version(3.3.0.430)
2024-12-17T09:30:09.183179+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install ci_util.c[322] [system]: Comparing installed app version:(3.3.0.430) and version of app the patch is meant for:(3.3.0.430)
2024-12-17T09:30:09.183259+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[3443] [system]: Manifest file pkgtype - CARS
2024-12-17T09:30:09.183288+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[4152] [system]: Verifying zip...
2024-12-17T09:30:32.843082+00:00 ise1 root: info:[patchinstall.sh] Current Disable_RSA_PSS=0
2024-12-17T09:30:32.847037+00:00 ise1 root: info:[patchinstall.sh] STARTING PATCH INSTALL SCRIPT. PATCHDIR: /storeddata/Installing/.1734427709 INSTALLDIRS:
2024-12-17T09:30:32.850535+00:00 ise1 root: info:[patchinstall.sh] NEW PATCH VER: 4 PRIOR PATCH VER: 0
2024-12-17T09:30:32.708937+00:00 ise1 ADE-SERVICE[1379]: [2783958]:[info] application:install cars_install.c[4241] [system]: Executing patch install script patchinstall.sh from patch.zip
2024-12-17T09:30:35.742426+00:00 ise1 root: info:[application:operation:cpmcontrol.sh] In Stop Monit
2024-12-17T09:30:35.755071+00:00 ise1 root: Monit daemon with pid [21765] killed
2024-12-17T09:30:36.816209+00:00 ise1 root: info:[application:operation:cpmcontrol.sh] Done Stop Monit
2024-12-17T09:30:37.125419+00:00 ise1 ADEOSShell[2791127]: ADEAUDIT 2062, type=USER, name=M&T Log Processor, username=system, cause=M&T Log Processor Stopped, adminipaddress=127.0.0.1, interface=CLI, detail=Stopping M&T Log Processor
2024-12-17T09:30:45.772624+00:00 ise1 root: info:[application:operation:adprobe.sh] adprobe:Stopping wmi probe...
2024-12-17T09:30:45.799438+00:00 ise1 root: info:[application:operation:adprobe.sh] adprobe:wmi probe is disabled
2024-12-17T09:30:45.871771+00:00 ise1 root: info:[application:operation:syslogprobe.sh] syslogprobe:Stopping syslog probe...
2024-12-17T09:30:45.898168+00:00 ise1 root: info:[application:operation:syslogprobe.sh] syslogprobe:syslog probe is disabled
2024-12-17T09:30:45.967252+00:00 ise1 root: info:[application:operation:restprobe.sh] restprobe:Stopping rest probe...
2024-12-17T09:30:45.994671+00:00 ise1 root: info:[application:operation:restprobe.sh] restprobe:rest probe is disabled
2024-12-17T09:30:46.074828+00:00 ise1 root: info:[application:operation:agentprobe.sh] agentprobe:Stopping agent probe...
2024-12-17T09:30:46.103781+00:00 ise1 root: info:[application:operation:agentprobe.sh] agentprobe:agent probe is disabled
2024-12-17T09:30:46.619128+00:00 ise1 root: info:[application:operation:appservercontrol.sh] Stopping ISE Application Server...
2024-12-17T09:30:46.621415+00:00 ise1 ADEOSShell[2791750]: ADEAUDIT 2062, type=USER, name=Application server status, username=system, cause=Application server stopped, adminipaddress=127.0.0.1, interface=CLI, detail=Application server stopped

2024-12-17T09:33:00.041627+00:00 ise1 root: info:[patchinstall.sh] ISE 3.3.0.430 patch 4 installFileSystem() INVOKED
2024-12-17T09:33:00.074901+00:00 ise1 root: info:[patchinstall.sh] Updating patched file: /storeddata/Installing/.1734427709/filesystem/opt/sp-hub/libs/cxf-core-3.5.7.jar
2024-12-17T09:33:00.085182+00:00 ise1 root: info:[patchinstall.sh] Updating patched file: /storeddata/Installing/.1734427709/filesystem/opt/sp-hub/libs/cxf-rt-ws-policy-3.5.7.jar
2024-12-17T09:33:00.094910+00:00 ise1 root: info:[patchinstall.sh] Updating patched file: /storeddata/Installing/.1734427709/filesystem/opt/sp-hub/libs/cxf-rt-bindings-soap-3.5.7.jar
2024-12-17T09:33:00.107845+00:00 ise1 root: info:[patchinstall.sh] Updating patched file: /storeddata/Installing/.1734427709/filesystem/opt/sp-hub/libs/prrt-interface-3.3.0.904.6-x86_64.jar
2024-12-17T09:33:00.117375+00:00 ise1 root: info:[patchinstall.sh] Updating patched file: /storeddata/Installing/.1734427709/filesystem/opt/sp-hub/libs/cxf-rt-transports-http-3.5.7.jar

Broadcast message from root@ise1 (pts/3) (Tue Dec 17 09:36:52 2024):

Trying to stop processes gracefully. Reload takes approximately 3 mins

Broadcast message from root@ise1 (pts/3) (Tue Dec 17 09:37:21 2024):

The system is going down for reboot NOW

Session terminated, killing shell... ...killed.