First, I’ve found that the web service takes a few minutes to start after the server boots. Even if you might be able to ping ISE, give it a couple more minutes. If the Admin portal still doesn’t load, log into the console and run this command to see which applications are still initializing or not running:

ISE-LAB/admin# show application status ise

If the server just rebooted, many of the services will still be in a “not running” state. If this is the case, give it a few more minutes.

On many occasions I’ve had all the processes start just fine except the Application Server. For some reason it gets stuck at Initializing.

One option is to simply restart the server with a reload command. But rather than restart the server, you can stop or start a single process from the command line. To restart the Application Server, use the following command:

ISE-LAB/admin# application start ise

A variation of this command starts the application in safe mode:

ISE-LAB/admin# application start ise safe

From the Cisco documentation, the purpose of safe mode is

“…to bypass access restrictions that may have been caused inadvertently. When the safe mode is used to start Cisco ISE services, the following behavior is observed:

• IP access restriction is temporarily disabled to allow administrators logging into correct IP access restrictions if they inadvertently lock themselves.
• On FIPS enabled hosts, if the ‘safe’ option is passed on application startup, the FIPS integrity check is temporarily disabled. Normally, if FIPS integrity check fails, Cisco ISE services are not started. Users can bypass the FIPS integrity check with the ‘safe’ option on application start.
• On FIPS enabled hosts, if the ‘safe’ option is passed on application startup, the hardware random number generator integrity check is disabled.
• If certificate-based authentication is used, the ‘safe’ option on application start will temporarily use username and password based authentication.”

In a highly available ISE cluster you can restart a single ISE server without any issue or interruption to end-user authentication, but I don’t prefer to do that if I can help it. It takes about two or three minutes for the service to start after running the command at which point it should be in a running state and the Admin portal available.

Thanks,

Phil

After spinning up new ISE VMs and getting certificates sorted out, you should create your ISE cluster by registering secondary, tertiary, etc nodes via the Primary node (see below).

When registering the secondary ISE server, I eventually got a Failed message after almost an hour of waiting. Because there’s so little in the database to replicate, this should have taken only a few minutes. The logs weren’t very helpful, either.

Just prior to this, I changed ISEV02 from Secondary to Standalone and then back again to Standalone. I didn’t suspect this would hurt anything since the secondary server wasn’t in a cluster yet.

After a few minutes of digging, I discovered that the application service, which handles the GUI among other things, would not start anymore. I reset all services, rebooted the server, and looked at some debugs. There was nothing there that helped, and restarting everything got the service only to initialize but not fully start.

The command show application status ise shows you all the processes related to ISE and is very helpful when configuring things that restart services. The third process from the top, Application Server, takes a little longer to start than the others, so I like to monitor it when working on initial ISE configurations.

To reset the application service, use application stop ise followed by application start ise.  To reset the entire config, use application reset-config ise.

After making my changes to ISEV02, the process was stuck in initializing. After a couple hours it went to not running. I tried the above commands, but nothing worked. Because this was a brand new installation, I had very little time into this process. Rather than  troubleshoot it further, I chose to re-deploy the virtual machine and start over.

This took literally minutes, so it was probably the best way to get moving on this project and make better use of my time. I hate doing that, but really it made no sense to troubleshoot a virtually blank ISE server when I could get a fresh one up and running so quickly.

I already knew that after getting the secondary (and tertiary, etc) ISE servers up and running, all the configuration should happen from the Primary – including registering other servers in the cluster. In this case, because the secondary ISE server was not in a cluster yet, I don’t know why changing from standalone and back again should have broken anything.

In conclusion, after getting the secondary ISE servers online, I won’t be touching anything on them directly anymore even if I think it won’t hurt anything.