Cisco Identity Services Engine Hardware Installation Guide, Release 2.0.1

Transcription

1 Cisco Identity Services Engine Hardware Installation Guide, Release First Published: Last Modified: Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax:

2 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) 2016 Cisco Systems, Inc. All rights reserved.

3 CONTENTS CHAPTER 1 Network Deployments in Cisco ISE 1 Cisco ISE Network Architecture 1 Cisco ISE Deployment Terminology 2 Node Types and Personas in Distributed Deployments 2 Administration Node 2 Policy Service Node 3 Monitoring Node 3 Standalone and Distributed ISE Deployments 3 Distributed Deployment Scenarios 3 Small Network Deployments 4 Split Deployments 4 Medium-Sized Network Deployments 5 Large Network Deployments 6 Centralized Logging 6 Load Balancers 6 Dispersed Network Deployments 7 Considerations for Planning a Network with Several Remote Sites 8 Deployment Size and Scaling Recommendations 9 Switch and Wireless LAN Controller Configuration Required to Support Cisco ISE Functions 10 CHAPTER 2 Install Cisco ISE Software on Cisco SNS Appliances 11 Cisco SNS 3400 Series Appliance Overview 11 Cisco SNS 3500 Series Appliance Overview 11 Cisco SNS 3500 Series Appliances 11 LED Indicators on Cisco SNS 3515 and 3595 Appliances 12 Cisco SNS-3515 and SNS-3595 Appliances Hardware Specifications 12 Cisco SNS-3515 or 3595 Appliance Front Panel View 13 Cisco SNS 3515 or SNS 3595 Appliance Back Panel View 16 iii

4 Contents Internal Diagnostic LEDs 18 Regulatory Compliance 20 Before You Begin 20 Safety Guidelines 20 Unpack and Inspect the Server 21 Prepare for Server Installation 22 Installation Guidelines 22 Rack Requirements 23 Equipment Requirements 24 Slide Rail Adjustment Range 24 Server Specifications 24 Physical Specifications 24 Environmental Specifications 24 Power Specifications 25 Install the Cisco SNS 3515 and Cisco SNS 3595 Hardware Appliances 26 Install the Cisco SNS 3515 or 3595 Appliance in a Rack 26 Install the Side Rails 27 Install the Cable Management Arm (Optional) 30 Reverse the Cable Management Arm (Optional) 32 Connect Cables 32 Connect the Network Interface 33 Ethernet Port Connector 33 Connect the Console 34 Connect the Keyboard and Video Monitor 35 Cable Management 36 Connect and Power On the Cisco SNS 3515 or 3595 Appliance 36 Connect and Power On the Server (Standalone Mode) 36 Local Connection Procedure 37 Remote Connection Procedure 37 Cisco Integrated Management Controller 38 Setup CIMC Configuration Utility 38 NIC Modes and NIC Redundancy Settings 40 Update the BIOS and Cisco IMC Firmware 41 Access the System BIOS 45 Install Cisco ISE Software on Cisco SNS Appliances 45 iv

5 Contents Install Cisco ISE on the Cisco SNS 3515 or 3595 Appliance 45 Download the Cisco ISE ISO Image 46 Install the ISE Server 46 Install ISE on the Cisco SNS 3515 or 3595 Appliance Remotely Using CIMC 47 Install ISE on the Cisco 3500 Appliance Using the USB Drive 48 Create a Bootable USB Device to Install Cisco ISE 49 Run the Setup Program 50 Verify the Installation Process 52 Reset the Administrator Password 53 Reimage the Cisco SNS 3500 Series Appliance 55 CHAPTER 3 Install ISE on a VMware Virtual Machine 57 Supported VMware Versions 57 Support for VMware vmotion 57 Support for Open Virtualization Format 58 Virtual Machine Requirements 59 Virtual Machine Appliance Size Recommendations 61 Disk Space Requirements 62 Disk Space Guidelines 63 Virtual Machine Resource and Performance Checks 64 On Demand Virtual Machine Performance Check Using the Show Tech Support Command 65 Virtual Machine Resource Check from the Cisco ISE Boot Menu 65 Obtain the Cisco ISE Evaluation Software 66 Install Cisco ISE on Virtual Machines 66 Deploy Cisco ISE on Virtual Machines Using OVA Templates 67 Install Cisco ISE on Virtual Machines Using the ISO File 67 Prerequisites for Configuring a VMware ESXi Server 68 Virtualization Technology Check 69 Enable Virtualization Technology on an ESXi Server 70 Configure VMware Server Interfaces for the Cisco ISE Profiler Service 70 Connect to the VMware Server Using the Serial Console 70 Configure a VMware Server 71 Increase Virtual Machine Power On Boot Delay Configuration 72 Configure a VMware System to Boot From a Cisco ISE Software DVD 72 Install Cisco ISE Software on a VMware System 73 v

6 Contents Cisco ISE ISO Installation on Virtual Machine Fails 74 Clone a Cisco ISE Virtual Machine 74 Clone a Cisco ISE Virtual Machine Using a Template 75 Create a Virtual Machine Template 76 Deploy a Virtual Machine Template 77 Change the IP Address and Hostname of a Cloned Virtual Machine 77 Connect a Cloned Cisco Virtual Machine to the Network 79 Migrate Cisco ISE VM from Evaluation to Production 79 CHAPTER 4 Install Cisco ISE on a Linux KVM 81 KVM Hypervisor Support 81 KVM Virtualization Check 81 Virtual Machine Resource and Performance Checks 81 On Demand Virtual Machine Performance Check Using the Show Tech Support Command 82 Virtual Machine Resource Check from the Cisco ISE Boot Menu 82 Obtain the Cisco ISE Evaluation Software 83 Install Cisco ISE on KVM 84 CHAPTER 5 Manage Administrator Accounts 87 CLI-Admin and Web-Based Admin User Right Differences 87 CLI Admin Users Creation 88 Web-Based Admin Users Creation 88 CHAPTER 6 Post-Installation and Maintenance Tasks 89 Log in to the Cisco ISE Web-Based Interface 89 Cisco ISE Configuration Verification 90 Verify Configuration Using a Web Browser 90 Verify Configuration Using the CLI 91 VMware Tools Installation Verification 92 Verify VMWare Tools Installation Using the Summary Tab in the vsphere Client 92 Verify VMWare Tools Installation Using the CLI 92 Support for Upgrading VMware Tools 93 Return Material Authorization 93 Reset a Password Due to Administrator Lockout 93 vi

7 Contents Change the IP Address of a Cisco ISE Appliance 94 View Installation and Upgrade History 95 Perform a System Erase 95 APPENDIX A Cisco ISE Ports Reference 97 Cisco ISE Infrastructure 97 Cisco ISE Administration Node Ports 98 Cisco ISE Monitoring Node Ports 99 Cisco ISE Policy Service Node Ports 100 Cisco ISE pxgrid Service Ports 104 OCSP and CRL Service Ports 105 vii

8 Contents viii

9 CHAPTER 1 Network Deployments in Cisco ISE Cisco ISE Network Architecture, page 1 Cisco ISE Deployment Terminology, page 2 Node Types and Personas in Distributed Deployments, page 2 Standalone and Distributed ISE Deployments, page 3 Distributed Deployment Scenarios, page 3 Small Network Deployments, page 4 Medium-Sized Network Deployments, page 5 Large Network Deployments, page 6 Deployment Size and Scaling Recommendations, page 9 Switch and Wireless LAN Controller Configuration Required to Support Cisco ISE Functions, page 10 Cisco ISE Network Architecture Cisco ISE architecture includes the following components: Nodes and persona types Cisco ISE node A Cisco ISE node can assume any or all of the following personas: Administration, Policy Service, Monitoring, or pxgrid Network resources Endpoints The policy information point represents the point at which external information is communicated to the Policy Service persona. For example, external information could be a Lightweight Directory Access Protocol (LDAP) attribute. 1

10 Cisco ISE Deployment Terminology Network Deployments in Cisco ISE Cisco ISE Deployment Terminology This guide uses the following terms when discussing Cisco ISE deployment scenarios: Term Service Node Node Type Persona Role Definition A specific feature that a persona provides such as network access, profiling, posture, security group access, monitoring, and troubleshooting. An individual physical or virtual Cisco ISE appliance. The Cisco ISE node can assume any of the following personas: Administration, Policy Service, Monitoring Determines the services provided by a node. A Cisco ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface depend on the role and personas that a node assumes. Determines if a node is a standalone, primary, or secondary node and applies only to Administration and Monitoring nodes. Node Types and Personas in Distributed Deployments Administration Node A Cisco ISE node can provide various services based on the persona that it assumes. Each node in a deployment can assume the Administration, Policy Service, pxgrid, and Monitoring personas. In a distributed deployment, you can have the following combination of nodes on your network: Primary and secondary Administration nodes for high availability A pair of Monitoring nodes for automatic failover One or more Policy Service nodes for session failover One or more pxgrid nodes for pxgrid services A Cisco ISE node with the Administration persona allows you to perform all administrative operations on Cisco ISE. It handles all system-related configurations that are related to functionality such as authentication, authorization, and accounting. In a distributed deployment, you can have a maximum of two nodes running the Administration persona. The Administration persona can take on the standalone, primary, or secondary role. 2

11 Network Deployments in Cisco ISE Policy Service Node Policy Service Node A Cisco ISE node with the Policy Service persona provides network access, posture, guest access, client provisioning, and profiling services. This persona evaluates the policies and makes all the decisions. You can have more than one node assume this persona. Typically, there would be more than one Policy Service node in a distributed deployment. All Policy Service nodes that reside in the same high-speed Local Area Network (LAN) or behind a load balancer can be grouped together to form a node group. If one of the nodes in a node group fails, the other nodes detect the failure and reset any URL-redirected sessions. At least one node in your distributed setup should assume the Policy Service persona. Monitoring Node A Cisco ISE node with the Monitoring persona functions as the log collector and stores log messages from all the Administration and Policy Service nodes in a network. This persona provides advanced monitoring and troubleshooting tools that you can use to effectively manage a network and resources. A node with this persona aggregates and correlates the data that it collects, and provides you with meaningful reports. Cisco ISE allows you to have a maximum of two nodes with this persona, and they can take on primary or secondary roles for high availability. Both the primary and secondary Monitoring nodes collect log messages. In case the primary Monitoring node goes down, the secondary Monitoring node automatically becomes the primary Monitoring node. At least one node in your distributed setup should assume the Monitoring persona. We recommend that you do not have the Monitoring and Policy Service personas enabled on the same Cisco ISE node. We recommend that the Monitoring node be dedicated solely to monitoring for optimum performance. Standalone and Distributed ISE Deployments A deployment that has a single Cisco ISE node is called a standalone deployment. This node runs the Administration, Policy Service, and Monitoring personas. A deployment that has more than one Cisco ISE node is called a distributed deployment. To support failover and to improve performance, you can set up a deployment with multiple Cisco ISE nodes in a distributed fashion. In a Cisco ISE distributed deployment, administration and monitoring activities are centralized, and processing is distributed across the Policy Service nodes. Depending on your performance needs, you can scale your deployment. A Cisco ISE node can assume any of the following personas: Administration, Policy Service, and Monitoring. Distributed Deployment Scenarios Small Network Deployments Medium-Sized Network Deployments Large Network Deployments 3

12 Small Network Deployments Network Deployments in Cisco ISE Small Network Deployments The smallest Cisco ISE deployment consists of two Cisco ISE nodes with one Cisco ISE node functioning as the primary appliance in a small network. The primary node provides all the configuration, authentication, and policy capabilities that are required for this network model, and the secondary Cisco ISE node functions in a backup role. The secondary node supports the primary node and maintains a functioning network whenever connectivity is lost between the primary node and network appliances, network resources, or RADIUS. Centralized authentication, authorization, and accounting (AAA) operations between clients and the primary Cisco ISE node are performed using the RADIUS protocol. Cisco ISE synchronizes or replicates all of the content that resides on the primary Cisco ISE node with the secondary Cisco ISE node. Thus, your secondary node is current with the state of your primary node. In a small network deployment, this type of configuration model allows you to configure both your primary and secondary nodes on all RADIUS clients by using this type of deployment or a similar approach. Figure 1: Small Network Deployment As the number of devices, network resources, users, and AAA clients increases in your network environment, you should change your deployment configuration from the basic small model and use more of a split or distributed deployment model. Split Deployments In split Cisco ISE deployments, you continue to maintain primary and secondary nodes as described in a small Cisco ISE deployment. However, the AAA load is split between the two Cisco ISE nodes to optimize the AAA workflow. Each Cisco ISE appliance (primary or secondary) needs to be able to handle the full workload if there are any problems with AAA connectivity. Neither the primary node nor the secondary nodes handles 4

13 Network Deployments in Cisco ISE Medium-Sized Network Deployments all AAA requests during normal network operations because this workload is distributed between the two nodes. The ability to split the load in this way directly reduces the stress on each Cisco ISE node in the system. In addition, splitting the load provides better loading while the functional status of the secondary node is maintained during the course of normal network operations. In split Cisco ISE deployments, each node can perform its own specific operations, such as network admission or device administration, and still perform all the AAA functions in the event of a failure. If you have two Cisco ISE nodes that process authentication requests and collect accounting data from AAA clients, we recommend that you set up one of the Cisco ISE nodes to act as a log collector. In addition, the split Cisco ISE deployment design provides an advantage because it allows for growth. Figure 2: Split Network Deployment Medium-Sized Network Deployments As small networks grow, you can keep pace and manage network growth by adding Cisco ISE nodes to create a medium-sized network. In medium-sized network deployments, you can dedicate the new nodes for all AAA functions, and use the original nodes for configuration and logging functions. 5

14 Large Network Deployments Network Deployments in Cisco ISE As the amount of log traffic increases in a network, you can choose to dedicate one or two of the secondary Cisco ISE nodes for log collection in your network. Figure 3: Medium-Sized Network Deployment Large Network Deployments Centralized Logging We recommend that you use centralized logging for large Cisco ISE networks. To use centralized logging, you must first set up a dedicated logging server that serves as a Monitoring persona (for monitoring and logging) to handle the potentially high syslog traffic that a large, busy network can generate. Because syslog messages are generated for outbound log traffic, any RFC 3164-compliant syslog appliance can serve as the collector for outbound logging traffic. A dedicated logging server enables you to use the reports and alert features that are available in Cisco ISE to support all the Cisco ISE nodes. You can also consider having the appliances send logs to both a Monitoring persona on the Cisco ISE node and a generic syslog server. Adding a generic syslog server provides a redundant backup if the Monitoring persona on the Cisco ISE node goes down. Load Balancers In large centralized networks, you should use a load balancer, which simplifies the deployment of AAA clients. Using a load balancer requires only a single entry for the AAA servers, and the load balancer optimizes the routing of AAA requests to the available servers. 6

15 Network Deployments in Cisco ISE Dispersed Network Deployments However, having only a single load balancer introduces the potential for having a single point of failure. To avoid this potential issue, deploy two load balancers to ensure a measure of redundancy and failover. This configuration requires you to set up two AAA server entries in each AAA client, and this configuration remains consistent throughout the network. Figure 4: Large Network Deployment Dispersed Network Deployments Dispersed Cisco ISE network deployments are most useful for organizations that have a main campus with regional, national, or satellite locations elsewhere. The main campus is where the primary network resides, is connected to additional LANs, ranges in size from small to large, and supports appliances and users in different geographical regions and locations. Large remote sites can have their own AAA infrastructure for optimal AAA performance. A centralized management model helps maintain a consistent, synchronized AAA policy. A centralized configuration model uses a primary Cisco ISE node with secondary Cisco ISE nodes. We still recommend that you use a separate 7

16 Considerations for Planning a Network with Several Remote Sites Network Deployments in Cisco ISE Monitoring persona on the Cisco ISE node, but each remote location should retain its own unique network requirements. Figure 5: Dispersed Deployment Considerations for Planning a Network with Several Remote Sites Verify if a central or external database is used, such as Microsoft Active Directory or Lightweight Directory Access Protocol (LDAP). Each remote site should have a synchronized instance of the external database that is available for Cisco ISE to access for optimizing AAA performance. The location of AAA clients is important. You should locate the Cisco ISE nodes as close as possible to the AAA clients to reduce network latency effects and the potential for loss of access that is caused by WAN failures. Cisco ISE has console access for some functions such as backup. Consider using a terminal at each site, which allows for direct, secure console access that bypasses network access to each node. If small, remote sites are in close proximity and have reliable WAN connectivity to other sites, consider using a Cisco ISE node as a backup for the local site to provide redundancy. Domain Name System (DNS) should be properly configured on all Cisco ISE nodes to ensure access to the external databases. 8

17 Network Deployments in Cisco ISE Deployment Size and Scaling Recommendations Deployment Size and Scaling Recommendations The following table provides guidance on the type of deployment, number of Cisco ISE nodes, and the type of appliance (small, medium, large) that you need based on the number of endpoints that connect to your network. Table 1: Cisco ISE Deployment Size and Scaling Recommendations Deployment Type Number of Nodes/Personas Appliance Platform Maximum Number of Dedicated Policy Service Nodes Number of Active Endpoints Small Standalone or redundant (2) nodes with Administration, Policy Service, and Monitoring personas enabled Cisco SNS 3515 Cisco SNS Maximum of 5,000 endpoints Maximum of 10,000 endpoints Medium Administration and Monitoring personas on single or redundant nodes. Maximum of 2 Administration and Monitoring nodes. Cisco SNS 3595 appliances for Administration and Monitoring personas Cisco SNS 3595 appliances for Administration and Monitoring personas 5 5 Maximum of 5,000 endpoints Maximum of 10,000 endpoints Large Dedicated Administration node/nodes. Maximum of 2 Administration nodes. Cisco SNS 3595 appliances for Administration and Monitoring personas 40 Maximum of 250,000 endpoints Dedicated Monitoring node/nodes. Maximum of 2 Monitoring nodes. Dedicated Policy Service nodes. Maximum of 40 Policy Service nodes. 9

18 Switch and Wireless LAN Controller Configuration Required to Support Cisco ISE Functions Network Deployments in Cisco ISE The following table provides guidance on the type of appliance that you would need for a dedicated Policy Service node based on the number of active endpoints the node services. Table 2: Policy Service Node Size Recommendations Form Factor Platform Size Appliance Maximum Endpoints Physical Small Cisco SNS ,000 Large Cisco SNS ,000 Virtual Machine Small/Medium/Large Comparable to physical appliance 3,000 to 20,000 Switch and Wireless LAN Controller Configuration Required to Support Cisco ISE Functions To ensure that Cisco ISE can interoperate with network switches and that functions from Cisco ISE are successful across the network segment, you must configure your network switches with certain required Network Time Protocol (NTP), RADIUS/AAA, IEEE 802.1X, MAC Authentication Bypass (MAB), and other settings. 10

19 CHAPTER 2 Install Cisco ISE Software on Cisco SNS Appliances Cisco SNS 3400 Series Appliance Overview, page 11 Cisco SNS 3500 Series Appliance Overview, page 11 Before You Begin, page 20 Install the Cisco SNS 3515 and Cisco SNS 3595 Hardware Appliances, page 26 Install Cisco ISE Software on Cisco SNS Appliances, page 45 Cisco SNS 3400 Series Appliance Overview Cisco SNS-3400 series appliance hardware consists of Cisco SNS 3415 and Cisco SNS 3495 appliances. For the Cisco SNS 3400 series hardware specifications, see the Cisco Secure Network Server Data Sheet. For the LED indicators on the Cisco SNS 3400 series appliances, see the Cisco Identity Services Engine Hardware Installation Guide, Release 2.0. Cisco SNS 3500 Series Appliance Overview Cisco SNS 3500 Series Appliances The Cisco SNS 3515 or Cisco SNS 3595 appliance is designed for performance and density over a wide range of business workloads, from web serving to distributed databases. Cisco ISE, Release is available on SNS 3515 and SNS 3595 platforms. Note The SNS 3515 and SNS 3595 appliances support only Cisco ISE or later releases. You cannot install a release earlier than on the SNS 3515 or SNS 3595 appliance. 11

20 Cisco SNS 3500 Series Appliances Install Cisco ISE Software on Cisco SNS Appliances Support for UEFI Secure Boot The SNS 3515 and SNS 3595 appliances support the Unified Extensible Firmware Interface (UEFI) secure boot feature. This feature ensures that only a Cisco-signed ISE image can be installed on the SNS 3515 and SNS 3595 appliances, and prevents installation of any unsigned operating system even with physical access to the device. For example, generic operating systems, such as Red Hat Enterprise Linux or Microsoft Windows cannot boot on this appliance. LED Indicators on Cisco SNS 3515 and 3595 Appliances This section describes the front- and rear-panel controls, ports, and LED indicators on the Cisco SNS 3515 and Cisco SNS 3595 appliances. Cisco SNS-3515 and SNS-3595 Appliances Hardware Specifications The following table describes the hardware specifications of Cisco SNS-3515 and Cisco SNS-3595 appliances. Cisco Identity Services Engine Appliance Hardware Specifications Diagrams Cisco SNS-3515-K9 Cisco UCS C220 M4 Single socket Intel Xeon E v3 series 2.40GHz, 6 total cores, 6*2 total threads 16 GB RAM 1 x 600-GB disk 6 GbE network interfaces For physical, environmental, and power specifications, see Server Specifications, on page 24 Cisco SNS-3515 or 3595 Appliance Front Panel View, on page 13 Cisco SNS 3515 or SNS 3595 Appliance Back Panel View, on page 16 Cisco SNS-3595-K9 Cisco UCS C220 M4 Dual socket Intel Xeon E v3 series 2.60GHz, 8 total cores, 8*2 total threads 64 GB RAM 4 x 600-GB disks RAID 10 6 GbE network interfaces For physical, environmental, and power specifications, see Server Specifications, on page

21 Install Cisco ISE Software on Cisco SNS Appliances Cisco SNS 3500 Series Appliances Cisco SNS-3515 or 3595 Appliance Front Panel View The following figure shows the components of the Cisco SNS-3515 or Cisco SNS-3595 appliance front panel view. Figure 6: Front Panel LEDs 1 Drive bays 1-8 support SAS/SATA drives 7 System status LED 2 Drive bays 1 and 2 support SAS/SATA and NVMe PCIe solid state drives (SSDs) 8 Fan status LED 3 Pull-out asset tag 9 Temperature status LED 4 Operations panel buttons and LEDs 10 Power supply status LED 5 Power button/power status LED 11 Network link activity LED 6 Unit identification button/led 12 KVM connector (used with KVM cable that provides two USB 2.0, one VGA, and one serial connector) The following table describes the LEDs located on the front panel of the Cisco SNS-3515 or Cisco SNS-3595 appliance. 13

22 Cisco SNS 3500 Series Appliances Install Cisco ISE Software on Cisco SNS Appliances Front Panel LEDs Hard drive fault Off The hard drive is operating properly. Amber Drive fault detected. Amber, blinking The device is rebuilding. Amber, blinking with one-second interval Drive locate function activated. Hard drive activity Off There is no hard drive in the hard drive tray (no access, no fault). Green The hard drive is ready. Green, blinking The hard drive is reading or writing data. Power button/led Off There is no AC power to the server. Amber The server is in standby power mode. Power is supplied only to the Cisco IMC and some motherboard functions. Green The server is in main power mode. Power is supplied to all server components. Unit identification Off The unit identification function is not in use. Blue The unit identification function is activated. 14

23 Install Cisco ISE Software on Cisco SNS Appliances Cisco SNS 3500 Series Appliances Front Panel LEDs System status Green The server is running in normal operating condition. Green, blinking The server is performing system initialization and memory check. Amber, steady The server is in a degraded operational state. For example: Power supply redundancy is lost. CPUs are mismatched. At least one CPU is faulty. At least one DIMM is faulty. At least one drive in a RAID configuration failed. Amber, blinking The server is in a critical fault state. For example: Boot failed. Fatal CPU and/or bus error is detected. Server is in an over-temperature condition. Fan status Green All fan modules are operating properly. Amber, steady One or more fan modules breached the critical threshold. Amber, blinking One or more fan modules breached the non-recoverable threshold. Temperature status Green The server is operating at normal temperature. Amber, steady One or more temperature sensors breached the critical threshold. Amber, blinking One or more temperature sensors breached the non-recoverable threshold. 15

24 Cisco SNS 3500 Series Appliances Install Cisco ISE Software on Cisco SNS Appliances Front Panel LEDs Power supply status Green All power supplies are operating normally. Amber, steady One or more power supplies are in a degraded operational state. Amber, blinking One or more power supplies are in a critical fault state. Network link activity Off The Ethernet link is idle. Green One or more Ethernet LOM ports are link-active, but there is no activity. Green, blinking One or more Ethernet LOM ports are link-active, with activity. Cisco SNS 3515 or SNS 3595 Appliance Back Panel View The following figure shows the components of the Cisco SNS-3515 and Cisco 3595 appliance back panel view. Figure 7: Back Panel LEDs 1 Grounding-lug hole (for DC power supplies) 9 1-GbE Ethernet dedicated management port; used to access CIMC 2 PCIe riser 1/slot 1 10 Serial port (RJ-45 connector) 3 PCIe riser 2/slot GbE Ethernet port (Eth 0) 4 1-GbE Ethernet port (Eth 2) 12 1-GbE Ethernet port (Eth 1) 5 1-GbE Ethernet port (Eth 3) 13 VGA video port (DB-15) 6 1-GbE Ethernet port (Eth 4) 14 Rear unit identification button/led 16

25 Install Cisco ISE Software on Cisco SNS Appliances Cisco SNS 3500 Series Appliances 7 1-GbE Ethernet port (Eth 5) 15 Power supplies (up to two, redundant as 1+1) 8 USB 3.0 ports (two) The following table describes the LEDs located on the back panel of the Cisco SNS 3515 or Cisco SNS 3595 appliance. LED Name Optional mlom 1-GbE SFP+ (there is a single status LED) State Off No link is present. Green, steady Link is active. Green, blinking Traffic is present on the active link. Optional mlom 1-GbE BASE-T link speed Off Link speed is 10 Mbps. Amber Link speed is 100 Mbps/1 Gbps. Green Link speed is 10 Gbps. Optional mlom 1-GbE BASE-T link status Off No link is present. Green Link is active. Green, blinking Traffic is present on the active link. 1-GbE Ethernet dedicated management link speed Off Link speed is 10 Mbps. Amber Link speed is 100 Mbps. Green Link speed is 1 Gbps. 1-GbE Ethernet dedicated management link status Off No link is present. Green Link is active. Green, blinking Traffic is present on the active link. 1-GbE Ethernet link speed Off Link speed is 10 Mbps. Amber Link speed is 100 Mbps. Green Link speed is 1 Gbps. 17

26 Cisco SNS 3500 Series Appliances Install Cisco ISE Software on Cisco SNS Appliances LED Name 1-GbE Ethernet link status State Off No link is present. Green Link is active. Green, blinking Traffic is present on the active link. Rear unit identification Off The unit identification LED is not in use. Blue The unit identification LED is activated. Power supply status AC power supplies: Off No AC input (12 V main power off, 12 V standby power off). Green, blinking 12 V main power off; 12 V standby power on. Green, solid 12 V main power on; 12 V standby power on. Amber, blinking Warning detected but 12 V main power on. Amber, solid Critical error detected; 12 V main power off. Internal Diagnostic LEDs The server has internal fault LEDs for CPUs, DIMMs, fan modules, SD cards, the RTC battery, and the mlom card. These LEDs are available only when the server is in standby power mode. An LED lights amber to indicate a faulty component. Note Power must be connected to the server for these LEDs to be operate. 18

27 Install Cisco ISE Software on Cisco SNS Appliances Cisco SNS 3500 Series Appliances The following figure shows the locations of these internal LEDs in Cisco SNS-3515 or Cisco SNS-3595 appliance. Figure 8: Cisco SNS-3515 or 3595 Internal Diagnostic LED Locations The following table describes the callouts in the above figure. 1 Fan module fault LEDs (one next to each fan connector on the motherboard) 4 SD card fault LEDs (one next to each bay) 2 CPU fault LEDs (one in front of each CPU) 5 RTC battery fault LED 3 DIMM fault LEDs (one in front of each DIMM socket on the motherboard) 6 mlom card fault LED (on motherboard next to mlom socket) The following table describes the internal diagnostic LEDs located inside the Cisco SNS-3515 or Cisco SNS-3595 appliance. LED Name Internal diagnostic LEDs (all) State Off Component is functioning normally. Amber Component has failed. 19

28 Before You Begin Install Cisco ISE Software on Cisco SNS Appliances Regulatory Compliance Before You Begin Safety Guidelines For regulatory compliance and safety information, see Regulatory Compliance and Safety Information for Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, and Cisco SNS-3595 Appliances. This section provides information on how you can prepare your site for safely installing the Cisco SNS-3515 or Cisco SNS-3595 appliance. Note Before you install, operate, or service a Cisco SNS-3515 or Cisco SNS-3595 appliance, review the Regulatory Compliance and Safety Information for Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, and Cisco SNS-3595 Appliances for important safety information. Warning Warning: IMPORTANT SAFETY INSTRUCTIONS This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device. Statement 1071 Warning Warning: To prevent the system from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of: 40 C (104 F). Statement 1047 Warning Warning: The plug-socket combination must be accessible at all times, because it serves as the main disconnecting device. Statement 1019 Warning This product relies on the building s installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than: 250 V, 15 A. Statement

29 Install Cisco ISE Software on Cisco SNS Appliances Unpack and Inspect the Server Warning Installation of the equipment must comply with local and national electrical codes. Statement 1074 When you are installing a server, use the following guidelines: Plan your site configuration and prepare the site before installing the server. See the Cisco UCS Site Preparation Guide for the recommended site planning tasks. Ensure that there is adequate space around the server to allow for servicing the server and for adequate airflow. The airflow in this server is from front to back. Ensure that the air-conditioning meets the thermal requirements listed in the Server Specifications, on page 24. Ensure that the cabinet or rack meets the requirements listed in the Rack Requirements, on page 23. Ensure that the site power meets the power requirements listed in the Power Specifications, on page 25. If available, you can use an uninterruptible power supply (UPS) to protect against power failures. Caution Avoid UPS types that use ferroresonant technology. These UPS types can become unstable with systems such as the Cisco UCS, which can have substantial current draw fluctuations from fluctuating data traffic patterns. Unpack and Inspect the Server Caution When handling internal server components, wear an ESD strap and handle modules by the carrier edges only. Note Keep the shipping container in case the server requires shipping in the future. Note The chassis is thoroughly inspected before shipment. If any damage occurred during transportation or any items are missing, contact your customer service representative immediately. To inspect the shipment: Step 1 Step 2 Step 3 Remove the server from its cardboard container and save all packaging material. Compare the shipment to the equipment list provided by your customer service representative and the list given below. Verify that you have all items. Check for damage and report any discrepancies or damage to your customer service representative. Have the following information ready: 21

30 Prepare for Server Installation Install Cisco ISE Software on Cisco SNS Appliances Invoice number of shipper (see the packing slip) Model and serial number of the damaged unit Description of damage Effect of damage on the installation Figure 9: Shipping Box Contents Prepare for Server Installation Installation Guidelines, on page 22 Rack Requirements, on page 23 Equipment Requirements, on page 24 Slide Rail Adjustment Range, on page 24 Installation Guidelines Warning Warning: To prevent the system from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of: 40 C (104 F). Statement

31 Install Cisco ISE Software on Cisco SNS Appliances Prepare for Server Installation Warning Warning: The plug-socket combination must be accessible at all times, because it serves as the main disconnecting device. Statement 1019 Warning This product relies on the building s installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than: 250 V, 15 A. Statement 1005 Warning Installation of the equipment must comply with local and national electrical codes. Statement 1074 Caution Avoid UPS types that use ferroresonant technology. These UPS types can become unstable with systems such as the Cisco UCS, which can have substantial current draw fluctuations from fluctuating data traffic patterns. When you are installing a server, use the following guidelines Plan your site configuration and prepare the site before installing the server. See the Cisco UCS Site Preparation Guide for the recommended site planning tasks. Ensure that there is adequate space around the server to allow for servicing the server and for adequate airflow. The airflow in this server is from front to back. Ensure that the air-conditioning meets the thermal requirements listed in the Server Specifications, on page 24. Ensure that the cabinet or rack meets the requirements listed in the Rack Requirements, on page 23. Ensure that the site power meets the power requirements listed in the Power Specifications, on page 25. If available, you can use an uninterruptible power supply (UPS) to protect against power failures. Rack Requirements This section provides the requirements for the standard open racks. The rack must be of the following type: A standard 19-in. (48.3-cm) wide, four-post EIA rack, with mounting posts that conform to English universal hole spacing, per section 1 of ANSI/EIA-310-D The rack post holes can be square 0.38-inch (9.6 mm), round 0.28-inch (7.1 mm), #12-24 UNC, or #10-32 UNC when you use the supplied slide rails. The minimum vertical rack space per server must be one RU, equal to 1.75 in. (44.45 mm). 23

32 Server Specifications Install Cisco ISE Software on Cisco SNS Appliances Equipment Requirements The slide rails supplied by Cisco Systems for this server do not require tools for installation. The inner rails (mounting brackets) are pre-attached to the sides of the server. Slide Rail Adjustment Range Server Specifications The slide rails for this server have an adjustment range of 24 to 36 inches (610 to 914 mm). This section lists the technical specifications for the server and includes the following sections: Physical Specifications The following table lists the physical specifications of the server. Description Height Width Depth Weight (fully loaded chassis) Specification 1.7 in. (4.3 cm) 16.9 in. (42.9 cm) 29.8 in. (75.8 cm) SNS 3515: 37.9 lb. (17.2 Kg) SNS 3595: 39.9 lb. (18.1 Kg) Environmental Specifications The following table lists the environmental specifications of the server. Description Temperature, operating Temperature, non-operating (when the server is stored or transported) Humidity, operating Humidity, nonoperating Specification 32 to 104 F (0 to 40 C) (Operating, sea level, no fan fail, no CPU throttling, turbo mode) -40 to 158 F (-40 to 70 C) 10 to 90% noncondensing 5 to 93% noncondensing 24

33 Install Cisco ISE Software on Cisco SNS Appliances Server Specifications Description Altitude, operating Altitude, non-operating Sound power level Measure A-weighted per ISO7779 LwAd (Bels) Operation at 73 F (23 C) Sound pressure level Measure A-weighted per ISO7779 LpAm (dba) Operation at 73 F (23 C) Specification 0 to 10,000 feet (0 to 3000m); maximum ambient temperature decreases by 1 C per 300m 0 to 40,000 feet (12,000m) Power Specifications The power specifications for the power supply options are listed in the following section: Note Do not mix power supply types in the server. Both power supplies must be identical. 770-WAC Power Supply Description AC input voltage range AC input frequency AC line input current (steady state) Maximum output power for each power supply Power supply output voltage Specification 90 to 264 VAC (self-ranging, 100 to 264 VAC nominal) Range: 47 to 63 Hz (single phase, 50 to 60 Hz nominal) 9.5 A peak at 100 VAC 4.5 A peak at 208 VAC 770 W Main power: 12 VDC Standby power: 12 VDC 25

34 Install the Cisco SNS 3515 and Cisco SNS 3595 Hardware Appliances Install Cisco ISE Software on Cisco SNS Appliances Install the Cisco SNS 3515 and Cisco SNS 3595 Hardware Appliances This section describes how to install your Cisco SNS 3515 or 3595 appliance and connect it to the network. It contains: Install the Cisco SNS 3515 or 3595 Appliance in a Rack, on page 26 Cisco Integrated Management Controller, on page 38 Connect Cables, on page 32 Connect and Power On the Cisco SNS 3515 or 3595 Appliance, on page 36 Before you begin the installation, read the Regulatory Compliance and Safety Information for the Cisco SNS 3515 or Cisco SNS 3595 Hardware Appliance. Warning Warning: Only trained and qualified personnel should be allowed to install, replace, or service this equipment. Statement 1030 Warning Warning: This unit is intended for installation in restricted access areas. A restricted access area can be accessed only through the use of a special tool, lock and key, or other means of security. Statement 1017 Install the Cisco SNS 3515 or 3595 Appliance in a Rack This section describes how to install the Cisco SNS 3515 or Cisco SNS 3595 appliance in a rack. 26

35 Install Cisco ISE Software on Cisco SNS Appliances Install the Cisco SNS 3515 or 3595 Appliance in a Rack Install the Side Rails Warning Warning: To prevent bodily injury when mounting or servicing this unit in a rack, you must take special precautions to ensure that the system remains stable. The following guidelines are provided to ensure your safety: This unit should be mounted at the bottom of the rack if it is the only unit in the rack. When mounting this unit in a partially filled rack, load the rack from the bottom to the top with the heaviest component at the bottom of the rack. If the rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack. Statement 1006 Step 1 Attach the inner rails to the sides of the server: Figure 10: Attach Inner Rail to Side of Server 1 Front side of the server 2 Locking clip on inner rail Step 2 a) Align an inner rail with one side of the server so that the three keyed slots in the rail align with the three pegs on the side of the server (see the figure above). b) Set the keyed slots over the pegs, and then slide the rail toward the front to lock it in place on the pegs. The front slot has a metal clip that locks over the front peg. c) Install the second inner rail to the opposite side of the server. Open the front securing plate on both slide-rail assemblies. The front end of the slide-rail assembly has a spring-loaded securing plate that must be open before you can insert the mounting pegs into the rack-post holes. 27

36 Install the Cisco SNS 3515 or 3595 Appliance in a Rack Install Cisco ISE Software on Cisco SNS Appliances On the outside of the assembly, push the green arrow button toward the rear to open the securing plate. Figure 11: Front Securing Mechanism, Inside of Front End 1 Front mounting pegs 3 Securing plate shown pulled back to open position 2 Rack post Step 3 Step 4 Install the outer slide rails into the rack: a) Align one slide-rail assembly front end with the front rack-post holes that you want to use. The slide rail front-end wraps around the outside of the rack post and the mounting pegs enter the rack-post holes from the outside-front (see the figure above). Note The rack post must be between the mounting pegs and the open securing plate. b) Push the mounting pegs into the rack-post holes from the outside-front. c) Press the securing plate release button, marked PUSH. The spring-loaded securing plate closes to lock the pegs in place. d) Adjust the slide-rail length, and then push the rear mounting pegs into the corresponding rear rack-post holes. The slide rail must be level front-to-rear. The rear mounting pegs enter the rear rack-post holes from the inside of the rack post. e) Attach the second slide-rail assembly to the opposite side of the rack. Ensure that the two slide-rail assemblies are at the same height with each other and are level front-to-back. f) Pull the inner slide rails on each assembly out toward the rack front until they hit the internal stops and lock in place. Insert the server into the slide rails: 28

37 Install Cisco ISE Software on Cisco SNS Appliances Install the Cisco SNS 3515 or 3595 Appliance in a Rack Caution This server can weigh up to 67 pounds (59 kilograms) when fully loaded with components. We recommend that you use a minimum of two people or a mechanical lift when lifting the server. Attempting this procedure alone could result in personal injury or equipment damage. Figure 12: Inner Rail Release Clip 1 Inner rail release clip 3 Outer rail attached to rack post 2 Inner rail attached to server and inserted into outer rail Step 5 (Optional) Secure the server in the rack more permanently by using the two screws that are provided with the slide rails. Perform this step if you plan to move the rack with servers installed. With the server fully pushed into the slide rails, open a hinged slam latch lever on the front of the server and insert the screw through the hole that is under the lever. The screw threads into the static part of the rail on the rack post and prevents the server from being pulled out. Repeat for the opposite slam latch. 29

38 Install the Cisco SNS 3515 or 3595 Appliance in a Rack Install Cisco ISE Software on Cisco SNS Appliances What to Do Next Install the Cable Management Arm (Optional) Note The CMA is reversible left to right. To reverse the CMA, see Reversing the Cable Management Arm (Optional) before installation. Step 1 Step 2 Step 3 Step 4 Step 5 With the server pushed fully into the rack, slide the CMA tab of the CMA arm that is farthest from the server onto the end of the stationary slide rail that is attached to the rack post (see the following figure). Slide the tab over the end of the rail until it clicks and locks. Slide the CMA tab that is closest to the server over the end of the inner rail that is attached to the server (see the following figure). Slide the tab over the end of the rail until it clicks and locks. Pull out the width-adjustment slider that is at the opposite end of the CMA assembly until it matches the width of your rack (see the following figure). Slide the CMA tab that is at the end of the width-adjustment slider onto the end of the stationary slide rail that is attached to the rack post (see the following figure). Slide the tab over the end of the rail until it clicks and locks. Open the hinged flap at the top of each plastic cable guide and route your cables through the cable guides as desired. Figure 13: Attach the Cable Management Arm to the Rear of the Slide Rails 30

39 Install Cisco ISE Software on Cisco SNS Appliances Install the Cisco SNS 3515 or 3595 Appliance in a Rack 1 CMA tab on arm farthest from server and end of stationary outer slide rail 3 CMA tab on width-adjustment slider and end of stationary outer slide rail 2 CMA tab on arm closest to the server and end of inner slide rail attached to server 4 Rear of server 31

40 Connect Cables Install Cisco ISE Software on Cisco SNS Appliances Reverse the Cable Management Arm (Optional) Step 1 Step 2 Step 3 Rotate the entire CMA assembly 180 degrees. The plastic cable guides must remain pointing upward. Flip the tabs at the end of each CMA arm so that they point toward the rear of the server. Pivot the tab that is at the end of the width-adjustment slider. Depress and hold the metal button on the outside of the tab and pivot the tab 180 degrees so that it points toward the rear of the Figure 14: Reverse the CMA 1 CMA tab on end of width-adjustment slider 2 Metal button for rotating Connect Cables This section describes how to connect your Cisco SNS-3515 or Cisco SNS-3595 appliance to the network and the appliance console. Connect the Network Interface, on page 33 Connect the Console, on page 34 Connect the Keyboard and Video Monitor, on page 35 Cable Management, on page 36 Attach cables (such as keyboard, monitor cables, if required) to the rear of the server. Route the cables properly and use the cable straps to secure the cables to the slide rails. See the Cisco SNS 3515 or SNS 3595 Appliance Back Panel View, on page 16 for reference on the rear view of the appliance. 32

41 Install Cisco ISE Software on Cisco SNS Appliances Connect Cables Connect the Network Interface Warning Warning: Do not work on the system or connect or disconnect cables during periods of lightning activity. Statement 1001 This section describes how to connect the Cisco SNS-3515 or Cisco SNS-3595 appliance Ethernet port. The Ethernet connector supports Serial over LAN (SOL) cables. The RJ-45 port supports standard straight-through and crossover Category 5 unshielded twisted-pair (UTP) cables. Cisco does not supply Category 5 UTP cables; these cables are available commercially. To connect the cable to the appliance Ethernet port: Step 1 Step 2 Step 3 Verify that the appliance is turned off. Connect one end of the cable to the GigabitEthernet 0 port on the appliance. Connect the other end to a switch in your network. Ethernet Port Connector The Cisco SNS 3515 or Cisco SNS-3595 appliance comes with twosix integrated dual-port Ethernet controllers. The controllers provide an interface for connecting to 10-Mb/s, 100-Mb/s, or 1000-Mb/s networks and provide full-duplex (FDX) capability, which enables simultaneous transmission and reception of data on the Ethernet LAN. Cisco ISE supports multiple NICs. To access the Ethernet port, connect a Category 3, 4, 5, 5E, or 6 unshielded twisted-pair (UTP) cable to the RJ-45 connector on the back of the appliance. The following table describes the UTP cable categories. Type 10BASE-T 100BASE-TX 1000BASE-T Description EIA Categories 3, 4, or 5 UTP (2 or 4 pair) up to 328 ft (100 m) EIA Category 5 UTP (2 pair) up to 328 ft (100 m) EIA Category 6 UTP (recommended), Category 5E UTP or 5 UTP (2 pair) up to 328 ft (100 m) 33

42 Connect Cables Install Cisco ISE Software on Cisco SNS Appliances The following figure shows the RJ-45 port and plug. Figure 15: RJ-45 Port and Plug Ethernet Port Pin-out Ethernet Port Pin Signal TxD+ TxD- RxD+ Termination network Termination network Description Transmit data + Transmit data - Receive data + No connection No connection Receive data- No connection No connection RxD- Termination network Termination network Connect the Console Warning Warning: Do not work on the system or connect or disconnect cables during periods of lightning activity. Statement 1001 Your Cisco SNS-3515 or Cisco SNS-3595 appliance has a DCE-mode console port for connecting a console terminal to your appliance. The appliance uses a DB-9 serial connector for the console port. The console port on the Cisco SNS-3515 or Cisco SNS-3595 appliance includes an EIA/TIA-232 asynchronous serial (DB-9) connector. This serial console connector (port) allows you to access the appliance locally by 34

43 Install Cisco ISE Software on Cisco SNS Appliances Connect Cables connecting a terminal either a PC running terminal-emulation software or an ASCII terminal to the console port. To connect a PC running terminal-emulation software to the console port, use a DB-9 female to DB-9 female straight-through cable. To connect an ASCII terminal to the console port, use a DB-9 female to DB-25 male straight-through cable with a DB-25 female to DB-25 female gender changer. To connect a terminal or a PC running terminal-emulation software to the console port on the Cisco SNS-3515 or Cisco SNS-3595 appliance: Step 1 Step 2 Connect the terminal using a straight-through cable to the console port. Configure your terminal or terminal-emulation software for 9600 baud, 8 data bits, no parity, 1 stop bit, and no hardware flow control. Connect the Keyboard and Video Monitor Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Statement 1001 This section describes how to connect a keyboard and video monitor to the Cisco SNS-3515 or Cisco SNS-3595 appliance. You can connect the keyboard and video monitor to the Cisco SNS-3515 or Cisco SNS-3595 appliance using the KVM connector available in the front panel of the Cisco SNS-3515 or Cisco SNS-3595 appliance. A KVM cable is shipped along with the appliance that provides two USB, one VGA, and one serial connector. The Cisco SNS-3515 or Cisco SNS-3595 appliance does not provide support for a mouse. The Cisco SNS-3515 or Cisco SNS-3595 provides USB ports on the rear of the appliance that can be used to connect a keyboard and video monitor. To connect a keyboard and video monitor to the appliance: Step 1 Step 2 Step 3 Step 4 Verify that the appliance is turned off. Connect the end of the keyboard cable to the PS/2 (keyboard) port which is located on the back panel of the appliance. Connect the end of the video monitor cable to the PS/2 (video monitor) port which is located on the back panel of the appliance. Power on the appliance. 35

44 Connect and Power On the Cisco SNS 3515 or 3595 Appliance Install Cisco ISE Software on Cisco SNS Appliances Cable Management Cable management is the most visual aspect of your appliance setup. However, cable management is often overlooked because it can be time consuming. Equipment racks and enclosures house more equipment today than ever before. This growth has increased the need for organized cable management both inside and outside the rack. Poor cable management not only leads to damaged cables or increased time for adding or changing cables, but also blocks critical airflow or access. These problems can lead to inefficiencies in the performance of your equipment or even downtime. There are many solutions to address cable management. They can range from simple cable management rings, to vertical or horizontal organizers, to troughs and ladders. All Cisco SNS-3515 or Cisco SNS-3595 appliance cables should be properly dressed so as not to interfere with each other or other pieces of equipment. Use local practices to ensure that the cables attached to your appliance are properly dressed. Proceed to the next section, Connect and Power On the Cisco SNS 3515 or 3595 Appliance, on page 36, to continue the installation process. Connect and Power On the Cisco SNS 3515 or 3595 Appliance Connect and Power On the Server (Standalone Mode), on page 36 Cisco Integrated Management Controller, on page 38 NIC Modes and NIC Redundancy Settings, on page 40 Connect and Power On the Server (Standalone Mode) Note This section describes how to power on the server, assign an IP address, and connect to server management when using the server in standalone mode. The server is shipped with the following default settings: The NIC mode is Shared LOM EXT. Shared LOM EXT mode enables the 1-Gb Ethernet ports and the ports on any installed Cisco virtual interface card (VIC) to access Cisco Integrated Management Interface (Cisco IMC). If you want to use the 10/100/1000 dedicated management ports to access Cisco IMC, you can connect to the server and change the NIC mode as described in Step 1 of the procedures given below. The NIC redundancy is active-active. All Ethernet ports are utilized simultaneously. DHCP is enabled. IPv4 is enabled. You can connect to the system using two methods: 36

45 Install Cisco ISE Software on Cisco SNS Appliances Connect and Power On the Cisco SNS 3515 or 3595 Appliance Local setup Use this procedure if you want to connect a keyboard and monitor to the system for setup. This procedure can use a KVM cable (Cisco PID N20-BKVM) or the ports on the rear of the server. See Local Connection Procedure, on page 37. Remote setup Use this procedure if you want to perform setup through your dedicated management LAN. See Remote Connection Procedure, on page 37. Note To configure the system remotely, you must have a DHCP server on the same network as the system. Your DHCP server must be preconfigured with the range of MAC addresses for this server node. The MAC address is printed on a label on the rear of the server node. This server node has a range of six MAC addresses assigned to the Cisco IMC. The MAC address printed on the label is the beginning of the range of six contiguous MAC addresses. Local Connection Procedure Step 1 Step 2 Attach a power cord to each power supply unit in your server, and then attach each power cord to a grounded AC power outlet. See Power Specifications, on page 25 for power specifications. Wait for approximately two minutes to let the server boot in standby power during the first bootup. You can verify system power status by looking at the system Power Status LED on the front panel (see LED Indicators on Cisco SNS 3515 and 3595 Appliances, on page 12). The system is in standby power mode when the LED is amber. Connect a USB keyboard and VGA monitor to the server using one of the following methods: Connect a USB keyboard and VGA monitor to the corresponding connectors on the rear panel (see Cisco SNS 3515 or SNS 3595 Appliance Back Panel View, on page 16). Connect an optional KVM cable (Cisco PID N20-BKVM) to the KVM connector on the front panel (see Cisco SNS-3515 or 3595 Appliance Front Panel View, on page 13 for the connector location). Connect your USB keyboard and VGA monitor to the KVM cable. Step 3 Open the Cisco IMC Configuration Utility: a) Press and hold the front panel power button for four seconds to boot the server. b) During bootup, press F8 when prompted to open the Cisco IMC Configuration Utility. This utility has two windows that you can switch between by pressing F1 or F2. c) Continue with Setup CIMC Configuration Utility, on page 38. Remote Connection Procedure Step 1 Attach a power cord to each power supply unit in your server, and then attach each power cord to a grounded AC power outlet. See Power Specifications, on page 25 for power specifications. 37

46 Connect and Power On the Cisco SNS 3515 or 3595 Appliance Install Cisco ISE Software on Cisco SNS Appliances Wait for approximately two minutes to let the server boot in standby power during the first bootup. You can verify system power status by looking at the system Power Status LED on the front panel (see LED Indicators on Cisco SNS 3515 and 3595 Appliances, on page 12). The system is in standby power mode when the LED is amber. Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Plug your management Ethernet cable into the dedicated management port on the rear panel (see Cisco SNS 3515 or SNS 3595 Appliance Back Panel View, on page 16). Allow your preconfigured DHCP server to assign an IP address to the server node. Use the assigned IP address to access and log in to the Cisco IMC for the server node. Consult with your DHCP server administrator to determine the IP address. Note The default user name for the server is admin. The default password is password. From the Cisco IMC Server Summary page, click Launch KVM Console. A separate KVM console window opens. From the Cisco IMC Summary page, click Power Cycle Server. The system reboots. Select the KVM console window. Note The KVM console window must be the active window for the following keyboard actions to work. When prompted, press F8 to enter the Cisco IMC Configuration Utility. This utility opens in the KVM console window. This utility has two windows that you can switch between by pressing F1 or F2. Step 9 Continue with Setup CIMC Configuration Utility, on page 38. Cisco Integrated Management Controller You can monitor the server inventory, health, and system event logs by using the built-in Cisco Integrated Management Controller (CIMC) GUI or CLI interfaces. See the user documentation for your firmware release at the following URL: products-installation-and-configuration-guides-list.html Setup CIMC Configuration Utility The following procedure is performed after you connect to the system and open the Cisco IMC Configuration Utility. Step 1 Set NIC mode and NIC redundancy: a) Set the NIC mode to choose which ports to use to access Cisco IMC for server management: Shared LOM EXT (default) This is the shared LOM extended mode, the factory-default setting. With this mode, the Shared LOM and Cisco Card interfaces are both enabled. In this mode, DHCP replies are returned to both the shared LOM ports and the Cisco card ports. If the system determines that the Cisco card connection is not getting its IP address from a Cisco UCS Manager system because the server is in standalone mode, further DHCP requests from the Cisco card are disabled. Use the Cisco Card NIC mode if you want to connect to Cisco IMC through a Cisco card in standalone mode. 38

47 Install Cisco ISE Software on Cisco SNS Appliances Connect and Power On the Cisco SNS 3515 or 3595 Appliance Shared LOM The 1-Gb Ethernet ports are used to access Cisco IMC. You must select a NIC redundancy and IP setting. Dedicated The dedicated management port is used to access Cisco IMC. You must select a NIC redundancy and IP setting. Cisco Card The ports on an installed Cisco UCS virtual interface card (VIC) are used to access the Cisco IMC. You must select a NIC redundancy and IP setting. See also the required VIC Slot setting below. VIC Slot If you use the Cisco Card NIC mode, you must select this setting to match where your VIC is installed. The choices are Riser1, Riser2, or Flex-LOM (the mlom slot). If you select Riser1, slot 1 is used. If you select Riser2, slot 2 is used. If you select Flex-LOM, you must use an mlom-style VIC in the mlom slot. b) Use this utility to change the NIC redundancy to your preference. This server has three possible NIC redundancy settings: None The Ethernet ports operate independently and do not fail over if there is a problem. This setting can be used only with the Dedicated NIC mode. Active-standby If an active Ethernet port fails, traffic fails over to a standby port. Active-active All Ethernet ports are utilized simultaneously. The Shared LOM EXT mode can have only this NIC redundancy setting. Shared LOM and Cisco Card modes can have both Active-standby and Active-active settings. Step 2 Step 3 Step 4 Choose whether to enable DHCP for dynamic network settings, or to enter static network settings. Note Before you enable DHCP, you must preconfigure your DHCP server with the range of MAC addresses for this server. The MAC address is printed on a label on the rear of the server. This server has a range of six MAC addresses assigned to Cisco IMC. The MAC address printed on the label is the beginning of the range of six contiguous MAC addresses. The static IPv4 and IPv6 settings include the following: The Cisco IMC IP address. The prefix/subnet. For IPv6, valid values are The gateway. For IPv6, if you do not know the gateway, you can set it as none by entering :: (two colons). The preferred DNS server address. For IPv6, you can set this as none by entering :: (two colons). (Optional) Use this utility to make VLAN settings. Press F1 to go to the second settings window, then continue with the next step. From the second window, you can press F2 to switch back to the first window. 39

48 Connect and Power On the Cisco SNS 3515 or 3595 Appliance Install Cisco ISE Software on Cisco SNS Appliances Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 (Optional) Set a hostname for the server. (Optional) Enable dynamic DNS and set a dynamic DNS (DDNS) domain. (Optional) If you check the Factory Default check box, the server reverts to the factory defaults. (Optional) Set a default user password. (Optional) Enable auto-negotiation of port settings or set the port speed and duplex mode manually. Note Auto-negotiation is applicable only when you use the Dedicated NIC mode. Auto-negotiation sets the port speed and duplex mode automatically based on the switch port to which the server is connected. If you disable auto-negotiation, you must set the port speed and duplex mode manually. (Optional) Reset port profiles and the port name. Press F5 to refresh the settings that you made. You might have to wait about 45 seconds until the new settings appear and the message, Network settings configured is displayed before you reboot the server in the next step. Press F10 to save your settings and reboot the server. Note If you chose to enable DHCP, the dynamically assigned IP and MAC addresses are displayed on the console screen during bootup. Use a browser and the IP address of the Cisco IMC to connect to the Cisco IMC management interface. The IP address is based upon the settings that you made (either a static address or the address assigned by your DHCP server). The default username for the server is admin. The default password is password. To manage the server, see the Cisco UCS C-Series Rack-Mount Server Configuration Guide or the Cisco UCS C-Series Rack-Mount Server CLI Configuration Guide for instructions on using those interfaces. The links to these documents are in the C-Series documentation roadmap: NIC Modes and NIC Redundancy Settings NIC Modes This server has the following NIC mode settings that you can choose from: Shared LOM EXT (default) This is the Shared LOM extended mode, the factory-default setting. With this mode, the shared LOM and Cisco Card interfaces are both enabled. In this mode, DHCP replies are returned to both the shared LOM ports and the Cisco card ports. If the system determines that the Cisco card connection is not getting its IP address from a Cisco UCS Manager system because the server is in standalone mode, further DHCP requests from the Cisco card are disabled. If the system determines that the Cisco card connection is getting its IP address from a Cisco UCS Manager system, the reply has parameters that automatically move the server to UCSM mode. Dedicated The dedicated management port is used to access Cisco IMC. You must select a NIC redundancy and IP setting. Shared LOM The 1-Gb Ethernet ports are used to access Cisco IMC. You must select a NIC redundancy and IP setting. Cisco Card The ports on an installed Cisco UCS virtual interface card (VIC) are used to access Cisco IMC. You must select a NIC redundancy and IP setting. 40

49 Install Cisco ISE Software on Cisco SNS Appliances Connect and Power On the Cisco SNS 3515 or 3595 Appliance See also the required VIC Slot setting below. VIC Slot If you use the Cisco Card NIC mode, you select this setting to match where your VIC is installed. The choices are Riser1, Riser2, or Flex-LOM (the mlom slot). If you select Riser1, slot 1 is used. If you select Riser2, slot 2 is used. If you select Flex-LOM, you must use an mlom-style VIC in the mlom sl NIC Redundancy This server has the following NIC redundancy settings that you can choose from: None The Ethernet ports operate independently and do not fail over if there is a problem. This setting can be used only with the Dedicated NIC mode. Active-standby If an active Ethernet port fails, traffic fails over to a standby port. Active-active All Ethernet ports are utilized simultaneously. Shared LOM EXT mode can have only this NIC redundancy setting. Shared LOM and Cisco Card modes can have both Active-standby and Active-active settings. The active/active setting uses Mode 5 or Balance-TLB (adaptive transmit load balancing). This is channel bonding that does not require any special switch support. The outgoing traffic is distributed according to the current load (computed relative to the speed) on each slave. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed receiving slave. Update the BIOS and Cisco IMC Firmware The following procedure describes how to upgrade the BIOS and CIMC firmware on Cisco SNS-3500 appliance hardware. Note This procedure is applicable only if you are currently on an SNS-3500 series appliance that does not support the Secure Boot feature (Cisco SNS-3515-ACS-K9 and Cisco SNS-3595-ACS-K9). This procedure is not applicable if you are already on Cisco ISE, Release or later on an SNS-3500 series appliance (starting from Release 2.0.1, Cisco ISE supports the Secure Boot feature and firmware updates are not required). For future releases, if firmware updates are required, we will provide necessary instructions with a link to the corresponding firmware image. 41

50 Connect and Power On the Cisco SNS 3515 or 3595 Appliance Install Cisco ISE Software on Cisco SNS Appliances Caution When you upgrade the BIOS firmware, you must also upgrade the CIMC firmware to the same version or the server will not boot. Do not power off the server until the BIOS and CIMC firmware are matching or the server will not boot. Cisco provides the Cisco Host Upgrade Utility to assist with simultaneously upgrading the BIOS, CIMC, and other firmware to compatible levels. The server uses firmware obtained from and certified by Cisco. Cisco provides release notes with each firmware image. Use the Cisco Host Upgrade Utility to simultaneously upgrade the CIMC, BIOS, and other firmware to compatible levels. There are several methods for updating the firmware: Recommended method for systems running firmware level 1.2 or later is to use the Cisco Host Upgrade Utility to simultaneously upgrade the CIMC, BIOS, LOM, LSI storage controller, and Cisco UCS P81E VIC firmware to compatible levels. See the Cisco Host Upgrade Utility Quick Reference Guide for your firmware level at the documentation roadmap link below. Note Your system firmware must be at minimum level 1.2 to use the Cisco Host Upgrade Utility. If your firmware is prior to level 1.2, you must use the methods below to update the BIOS and CIMC firmware individually. You can upgrade the BIOS using the EFI interface, or upgrade from a Windows or Linux platform. See the Cisco UCS C-Series Rack-Mount Server BIOS Upgrade Guide. You can upgrade the CIMC and BIOS firmware by using the CIMC GUI interface. See the Cisco UCS C-Series Rack-Mount Server Configuration Guide. You can upgrade the CIMC and BIOS firmware by using the CIMC CLI interface. See the Cisco UCS C-Series Rack-Mount Server CLI Configuration Guide. For links to the documents listed above, see the documentation roadmap at the following URL: To change the BIOS settings for your server, follow these steps. Detailed instructions are also printed on the BIOS screens. If you are accessing the system BIOS for the first time, perform the tasks listed in Access the System BIOS, on page 45. Before You Begin Download the latest Cisco UCS Host Upgrade Utility software for the Cisco SNS-3500 series appliance from the following Cisco.com download page to your local system. Step 1 Use a browser and the IP address of the CIMC to log in to the CIMC Setup Utility. The IP address is based upon your CIMC config settings that you made (either a static address or the address assigned by your DHCP server). 42

51 Install Cisco ISE Software on Cisco SNS Appliances Connect and Power On the Cisco SNS 3515 or 3595 Appliance Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 The default user name for the server is admin. The default password is password. Use your CIMC credentials to log in. Click Launch KVM Console. Choose Virtual Media > Map CD/DVD to select the Cisco UCS Host Utility Upgrade software from the system running your client browser, and click Map Device. Choose Macros > Static Macros > Ctrl-Alt-Del to boot the appliance using the Cisco UCS Host Utility software image. Press F6 to bring up the boot menu. Select the Cisco KVM Mapped CD/DVD that you mapped and press Enter. The Cisco UCS Host Upgrade Utility appears as shown in the image below. Figure 16: Cisco Host Upgrade Utility 43

52 Connect and Power On the Cisco SNS 3515 or 3595 Appliance Install Cisco ISE Software on Cisco SNS Appliances Step 8 Step 9 Check the check boxes next to Cisco IMC and BIOS and click Update. After the update is complete, click Exit. 44

53 Install Cisco ISE Software on Cisco SNS Appliances Install Cisco ISE Software on Cisco SNS Appliances Access the System BIOS To change the BIOS settings for your server, follow these steps. Detailed instructions are also printed on the BIOS screens. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Enter the BIOS setup utility by pressing the F2 key when prompted during bootup. Note The version and build of the current BIOS are displayed on the Main page of the utility. Use the arrow keys to select the BIOS menu page. Highlight the field to be modified by using the arrow keys. Press Enter to select the field that you want to change, and then modify the value in the field. Press the right arrow key until the Exit menu screen is displayed. Follow the instructions on the Exit menu screen to save your changes and exit the setup utility (or Press F10). You can exit without saving changes by pressing Esc. Install Cisco ISE Software on Cisco SNS Appliances Install Cisco ISE on the Cisco SNS 3515 or 3595 Appliance The Cisco SNS 3515 and Cisco SNS 3595 appliances are preinstalled with the ISE software. This section gives you an overview of the installation process and the tasks that you must perform before installing ISE. Before you begin installing ISE, you must: Step 1 Open the box and check the contents. See Unpack and Inspect the Server, on page 21. Step 2 Read about the Cisco SNS 3500 Series Appliances, on page 11. Step 3 Read the general precautions and safety warnings in Before You Begin, on page 20. Step 4 Install the appliance in the rack. See Prepare for Server Installation, on page 22. Step 5 Connect the Cisco SNS-3515 or Cisco SNS-3595 to the network and appliance console. See Connect Cables, on page 32. Step 6 Power up the Cisco SNS-3515 or Cisco SNS-3595 appliance. See Connect and Power On the Cisco SNS 3515 or 3595 Appliance, on page 36. Step 7 Run the setup command at the CLI prompt to configure the initial settings for the ISE server. See Run the Setup Program, on page 50. The setup can be done by using the appliance console or CIMC. You can use the Cisco UCS Server Configuration Utility, Release 3.0 User Guide to configure the Cisco SNS-3515 or Cisco SNS-3595 appliance. You can also see the Cisco UCS C-Series Rack Server guides for more information on Cisco SNS-3515 or Cisco SNS-3595 appliance. 45

54 Download the Cisco ISE ISO Image Install Cisco ISE Software on Cisco SNS Appliances Download the Cisco ISE ISO Image Download the ISO image to install Cisco ISE on Cisco SNS appliance. Step 1 Step 2 Go to You must already have valid Cisco.com login credentials to access this link. Click Download Software for this Product The Cisco ISE software image comes with a 90-day evaluation license already installed, so you can begin testing all Cisco ISE services when the installation and initial configuration is complete. Install the ISE Server After you download the Cisco ISE ISO image, you can use any of the following options to install and set up the Cisco ISE software on your appliance: Note If you are reimaging a 3400 series appliance with Release or later software, ensure that you have the latest BIOS and CIMC version on your appliance. See Update the BIOS and Cisco IMC Firmware, on page 41 for information on how to update the BIOS and CIMC firmware. Configure the Cisco Integrated Management Interface (CIMC) and use it to install Cisco ISE remotely via the network. See: 1 Set up the CIMC configuration utility. See Cisco Integrated Management Controller, on page 38 for more information. 2 Install ISE on the Cisco SNS 3515 or 3595 Appliance Remotely Using CIMC, on page 47 3 Run the Setup Program, on page 50 Create a bootable USB Drive and use it to install Cisco ISE. See: 1 Create a Bootable USB Device to Install Cisco ISE, on page 49 2 Install ISE on the Cisco 3500 Appliance Using the USB Drive, on page 48 3 Run the Setup Program, on page 50 46

55 Install Cisco ISE Software on Cisco SNS Appliances Install the ISE Server Install ISE on the Cisco SNS 3515 or 3595 Appliance Remotely Using CIMC After you have configured the CIMC for your appliance, you can use it to manage your Cisco SNS-3515 or Cisco SNS-3595 appliance. You can perform all operations including BIOS configuration on your Cisco SNS-3515 or Cisco SNS-3595 appliance through the CIMC. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Connect to the CIMC for server management. Connect Ethernet cables from your LAN to the server, using the ports that you selected in NIC Mode setting. The Active-active and Active-passive NIC redundancy settings require you to connect to two ports. Use a browser and the IP address of the CIMC to log in to the CIMC Setup Utility. The IP address is based upon your CIMC config settings that you made (either a static address or the address assigned by your DHCP server). Note The default user name for the server is admin. The default password is password. Use your CIMC credentials to log in. Click Launch KVM Console. Choose Virtual Media > Activate Virtual Devices. Choose Virtual Media > Map CD/DVD to select the ISE ISO from the system running your client browser, and click Map Device. Choose Macros > Static Macros > Ctrl-Alt-Del to boot the Cisco SNS-3515 or Cisco SNS-3595 appliance using the ISO image. Press F6 to bring up the boot menu. A screen similar to the following one appears. Figure 17: Select Boot Device Step 9 Step 10 Select the CD/DVD that you mapped and press Enter. The following message is displayed. Example: Please wait, preparing to boot The following options appear: Cisco ISE Installation (Serial Console) Cisco ISE Installation (Keyboard/Monitor) System Utilities (Serial Console) System Utilities (Keyboard/Monitor) At the boot prompt, press Enter to install Cisco ISE using a serial console. 47

56 Install the ISE Server Install Cisco ISE Software on Cisco SNS Appliances Step 11 Step 12 Step 13 If you want to use a keyboard and monitor, use the arrow key to select the Cisco ISE Installation (Keyboard/Monitor) option. The following message appears. ********************************************** Please type 'setup' to configure the appliance ********************************************** At the prompt, type setup to start the Setup program. See Run the Setup Program, on page 50 for details about the Setup program parameters. After you enter the network configuration parameters in the Setup mode, the appliance automatically reboots, and returns to the shell prompt mode. Exit from the shell prompt mode. The appliance comes up. Step 14 Continue with Verify the Installation Process, on page 52. Install ISE on the Cisco 3500 Appliance Using the USB Drive To install ISE on the Cisco SNS 3515 or Cisco SNS 3595 appliance using the USB drive: Before You Begin You must create a bootable USB drive. See Create a Bootable USB Device to Install Cisco ISE, on page 49. Step 1 Step 2 Step 3 Step 4 Plug in your bootable USB drive that has the Cisco ISE ISO image in to the USB port. Restart the system through the KVM console and press F6 to go to the Boot Menu. From the Boot Menu, choose the USB as the boot device and press Enter. Use the arrow keys to select the USB boot device. At the boot prompt, choose one of the following and press Enter. Cisco ISE Installation (Serial Console) to install Cisco ISE through a serial console Cisco ISE Installation (Keyboard/Monitor) to install Cisco ISE using a keyboard and monitor. 48

57 Install Cisco ISE Software on Cisco SNS Appliances Install the ISE Server Example: Figure 18: Boot Prompt Step 5 Step 6 After you enter the network configuration parameters in Setup mode, the appliance automatically reboots and returns to the shell prompt mode. Exit from the shell prompt mode. The appliance comes up. Step 7 Continue with Verify the Installation Process, on page 52. Create a Bootable USB Device to Install Cisco ISE Use the Fedora Media Writer tool to create a bootable USB device from the Cisco ISE installation ISO file. Before You Begin Download Fedora Media Writer to the local system from the following location: wiki/how_to_create_and_use_live_usb. Note Other USB tools might work, but Cisco recommends using Fedora Media Writer as it has been qualified. Download the Cisco ISE installation ISO file to the local system. 49

58 Install the ISE Server Install Cisco ISE Software on Cisco SNS Appliances Use an 8-GB (or higher) USB device. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Plug in the USB device to the local system. Launch Fedora Media Writer. Click Browse from the Use existing Live CD area and select the Cisco ISE ISO file. (If there is only one USB device connected to the local system, it is selected automatically) Select the USB device from the Target Device drop down. Click Create Live USB. The progress bar indicates the progress of the bootable USB creation. After this process is complete, the contents of the USB drive is available in the local system that you used to run the USB tool. There are two text files that you must manually update before you can install Cisco ISE. From the USB drive, open the following text files in a text editor: syslinux/syslinux.cfg EFI/BOOT/grub.cfg Step 7 Replace the term "cdrom:" in both the files. If you have a Cisco SNS 3415 appliance, replace the term "cdrom:" with "hd:sda1" in both the files. If you have a Cisco SNS 3495, 3515, or 3595 appliance, replace the term "cdrom:" with "hd:sdb1" in both the files. Specifically, replace all instances of the "cdrom:" string. For example, replace ks=cdrom:/ks.cfg with ks=hd:sdb1:/ks.cfg Step 8 Step 9 Step 10 Save the files and exit. Safely remove the USB device from the local system. Plug in the bootable USB device to the Cisco ISE appliance, restart the appliance, and boot from the USB drive to install Cisco ISE. Run the Setup Program This section describes the setup process to configure the ISE server. The setup program launches an interactive command-line interface (CLI) that prompts you for the required parameters. An administrator can use the console or a dumb terminal to configure the initial network settings and provide the initial administrator credentials for the ISE server using the setup program. The setup process is a one-time configuration task. 50

59 Install Cisco ISE Software on Cisco SNS Appliances Install the ISE Server To run the setup program: Step 1 Step 2 Power on the appliance The setup prompt appears: Please type setup to configure the appliance localhost login: At the login prompt, enter setup and press Enter. The console displays a set of parameters. You must enter the parameters as described in the following table Table 3: Cisco ISE Setup Program Parameters Prompt Hostname (eth0) Ethernet interface address Netmask Default gateway DNS domain name Primary name server Add/Edit another name server Primary NTP server Add/Edit another NTP server Description Must not exceed 15 characters. Valid characters include alphanumerical (A Z, a z, 0 9), and the hyphen (-). The first character must be a letter. Note We recommend that you use lowercase letters to ensure that certificate authentication in Cisco ISE is not impacted by minor differences in certificate-driven verifications. You cannot use "localhost" as hostname for a node. Must be a valid IPv4 address for the Gigabit Ethernet 0 (eth0) interface. Must be a valid IPv4 netmask. Must be a valid IPv4 address for the default gateway. Cannot be an IP address. Valid characters include ASCII characters, any numerals, the hyphen (-), and the period (.). Must be a valid IPv4 address for the primary name server. Must be a valid IPv4 address for an additional name server. Must be a valid IPv4 address or hostname of a Network Time Protocol (NTP) server. Must be a valid NTP domain. Example isebeta example.com (Optional) Allows you to configure multiple name servers. To do so, enter y to continue. clock.nist.gov (Optional) Allows you to configure multiple NTP servers. To do so, enter y to continue. 51

60 Install the ISE Server Install Cisco ISE Software on Cisco SNS Appliances Prompt Description Example System Time Zone Username Password Must be a valid time zone. For example, for Pacific Standard Time (PST), the System Time Zone is PST8PDT (or Coordinated Universal Time (UTC) minus 8 hours). You can run the show timezones command from the Cisco ISE CLI for a complete list of supported time zones. Note We recommend that you set all Cisco ISE nodes to the UTC time zone. This time zone setting ensures that the reports, logs, and posture agent log files from the various nodes in your deployment are always synchronized with regard to the time stamps. Identifies the administrative username used for CLI access to the Cisco ISE system. If you choose not to use the default (admin), you must create a new username. The username must be three to eight characters in length and be composed of valid alphanumeric characters (A Z, a z, or 0 9). Identifies the administrative password that is used for CLI access to the Cisco ISE system. You must create this password because there is no default. The password must be a minimum of six characters in length and include at least one lowercase letter (a z), one uppercase letter (A Z), and one numeral (0 9). UTC (default) admin (default) MyIseYPass2 After the setup program is run, the system reboots automatically. Now, you can log in to Cisco ISE using the username and password that was configured during the setup process. Verify the Installation Process To verify that you have correctly completed the installation process: Step 1 Step 2 Step 3 When the system reboots, at the login prompt enter the username you configured during setup, and press Enter. At password prompt, enter the password you configured during setup, and press Enter. Verify that the application has been installed properly by entering the show application command, and press Enter. The console displays: Cisco Identity Services Engine Version: Build Date: Mon Jan 11 19:31: Install Date: Tue Jan 12 14:35:

61 Install Cisco ISE Software on Cisco SNS Appliances Reset the Administrator Password Note The version and date might change for different versions of this release. Step 4 Check the status of the ISE processes by entering the show application status ise command, and press Enter. The console displays: ise/admin# show application status ise ISE PROCESS NAME STATE PROCESS ID Database Listener running 3638 Database Server running 45 PROCESSES Application Server running 5992 Profiler Database running 4483 AD Connector running 6401 M&T Session Database running 2313 M&T Log Collector running 6247 M&T Log Processor running 6274 Certificate Authority Service running 6213 pxgrid Infrastructure Service disabled pxgrid Publisher Subscriber Service disabled pxgrid Connection Manager disabled pxgrid Controller disabled Identity Mapping Service disabled Reset the Administrator Password If you are not able to log in to the system due to the loss of the administrator password, you can use the Cisco ISE software DVD to reset the administrator password. Note You can also use the bootable USB drive and CIMC to reset the administrator password. Before You Begin Make sure you understand the following connection-related conditions that can cause a problem when attempting to use the Cisco ISE Software DVD to start up a Cisco ISE appliance: You have a terminal server associated with the serial console connection to the Cisco ISE appliance that is set to exec. Setting it to no exec allows you to use a keyboard and video monitor connection and a serial console connection. You have a keyboard and video monitor connection to the Cisco ISE appliance (this can be either a remote keyboard and a video monitor connection or a VMware vsphere client console connection). You have a serial console connection to the Cisco ISE appliance. Step 1 Step 2 Power up the appliance. Insert the Cisco ISE Software DVD. 53

62 Reset the Administrator Password Install Cisco ISE Software on Cisco SNS Appliances For example, the Cisco ISE console displays the following message: Cisco ISE Installation (Serial Console) Cisco ISE Installation (Keyboard/Monitor) System Utilities (Serial Console) System Utilities (Keyboard/Monitor) Step 3 At the system prompt, use the arrow keys to select the System Utilities (Keyboard/Monitor) option if you use a keyboard and video monitor connection to the appliance, or select the System Utilities (Serial Console) option if you use a local serial console port connection, and press Enter. The system displays the ISO utilities menu as shown below. Available System Utilities: [1] Recover Administrator Password [2] Virtual Machine Resource Check [3] Perform System Erase [q] Quit and reload Step 4 Enter option [1-3] q to Quit: At the system prompt, enter 1 and press Enter. The console displays: Admin Password Recovery This utility will reset the password for the specified ADE-OS administrator. At most the first five administrators will be listed. To abort without saving changes, enter [q] to Quit and return to utilities menu Admin Usernames: [1] admin [2] admin2 [3] admin3 [4] admin4 Step 5 Step 6 Step 7 Enter choice between [1-4] or q to Quit: Select the admin user whose password you want to reset. Enter the new password and verify it. Enter Y to save the changes. 54

63 Install Cisco ISE Software on Cisco SNS Appliances Reimage the Cisco SNS 3500 Series Appliance Reimage the Cisco SNS 3500 Series Appliance The Cisco SNS-3500 series appliances do not have built-in DVD drives. Therefore, to reimage a Cisco ISE hardware appliance with Cisco ISE software, you can do one of the following: Note The SNS 3515 and SNS 3595 appliances support the Unified Extensible Firmware Interface (UEFI) secure boot feature. This feature ensures that only a Cisco-signed ISE image can be installed on the SNS 3515 and SNS 3595 appliances, and prevents installation of any unsigned operating system even with physical access to the device. For example, generic operating systems, such as Red Hat Enterprise Linux or Microsoft Windows cannot boot on this appliance. The SNS 3515 and SNS 3595 appliances support only Cisco ISE or later releases. You cannot install a release earlier than on the SNS 3515 or SNS 3595 appliance. Use the Cisco Integrated Management Controller (CIMC) interface to map the installation.iso file to the virtual DVD device. See Install ISE on the Cisco SNS 3515 or 3595 Appliance Remotely Using CIMC, on page 47. Create an install DVD with the installation.iso file and plug in an USB external DVD drive and boot the appliance from the DVD drive. Create a bootable USB device using the installation.iso file and boot the appliance from the USB drive. See Install ISE on the Cisco 3500 Appliance Using the USB Drive, on page

64 Reimage the Cisco SNS 3500 Series Appliance Install Cisco ISE Software on Cisco SNS Appliances 56

65 CHAPTER 3 Install ISE on a VMware Virtual Machine Supported VMware Versions, page 57 Support for VMware vmotion, page 57 Support for Open Virtualization Format, page 58 Virtual Machine Requirements, page 59 Virtual Machine Resource and Performance Checks, page 64 Obtain the Cisco ISE Evaluation Software, page 66 Install Cisco ISE on Virtual Machines, page 66 Migrate Cisco ISE VM from Evaluation to Production, page 79 Supported VMware Versions Cisco ISE supports the following VMware servers and clients: VMware version 8 (default) for ESXi 5.x VMware version 11 (default) for ESXi 6.x Support for VMware vmotion Cisco ISE supports the VMware vmotion feature that allows you to migrate live virtual machine (VM) instances (running any persona) between hosts. For the VMware vmotion feature to be functional, the following conditions must be met: Shared storage The storage for the VM must reside on a storage area network (SAN), and the SAN must be accessible by all the VMware hosts that can host the VM being moved. VMFS volume sharing The VMware host must use shared virtual machine file system (VMFS) volumes. Gigabit Ethernet interconnectivity The SAN and the VMware hosts must be interconnected with Gigabit Ethernet links. 57

66 Support for Open Virtualization Format Install ISE on a VMware Virtual Machine Processor compatibility A compatible set of processors must be used. Processors must be from the same vendor and processor family for vmotion compatibility. Support for Open Virtualization Format Cisco ISE supports the Open Virtualization Format (OVF) and offers OVA templates that you can use to install and deploy Cisco ISE on virtual machines (VMs). The following OVA templates are available: If you need to customize the disk size, CPU, or memory allocation, you can manually deploy Cisco ISE using the standard.iso image. However, it is important that you ensure the minimum requirements and resource reservations specified in this document are met. The OVA templates simplify ISE virtual appliance deployment by automatically applying the minimum resources required for each platform. ISE xxx.xxx-eval.ova Use this template if you are evaluating Cisco ISE and the evaluation license would support up to 100 endpoints. ISE xxx.xxx-virtual-SNS3415.ova Use this template if your VMware appliance specification is comparable with an SNS-3415 appliance. ISE xxx.xxx-virtual-SNS3495.ova Use this template if your VMware appliance specification is comparable with an SNS-3495 appliance. ISE xxx.xxx-virtual-SNS3515.ova Use this template if your VMware appliance specification is comparable with an SNS-3515 appliance. ISE xxx.xxx-virtual-SNS3595.ova Use this template if your VMware appliance specification is comparable with an SNS-3595 appliance. The following table provides OVA template reservations. OVA Template Virtual Eval OVA Virtual SNS-3415 OVA Virtual SNS-3495 OVA Virtual SNS-3515 OVA Memory 4 GB RAM (no reservation) Note 16 GB RAM 32 GB RAM 16 GB RAM For evaluating guest access and basic access policy flows, a minimum of 4 GB RAM is required. For evaluating advanced features such as pxgrid, internal CA, SXP, Device Administration, and Passive Identity Services, we suggest that you configure your VM to have 16 GB RAM after deploying the Eval OVA. CPU 2300 MHz (no reservation) 8000 MHz MHz MHz 58

67 Install ISE on a VMware Virtual Machine Virtual Machine Requirements OVA Template Virtual SNS-3595 OVA Memory 64 GB RAM CPU MHz Virtual Machine Requirements To achieve performance and scalability comparable to the Cisco ISE hardware appliance, the VMware virtual machine should be allocated system resources equivalent to the Cisco SNS 3515 and 3595 appliances. Table 4: VMware System Requirements Requirement Type CPU Specifications Evaluation: Clock Speed: 2.0 GHz or faster Number of Cores: 2 CPU cores Production: Clock Speed: 2.0 GHz or faster Number of Cores: 6 (Small) to 8 (Large) CPU cores Memory Cisco ISE supports Hyperthreading. We recommend that you enable Hyperthreading, if it is available. Note Note Even though Hyperthreading might improve overall VM performance, it does not change the supported scaling limits per VM appliance. Additionally, you must still allocate CPU resources based on the required number of physical cores, not the number of logical processors. Refer to the OVA Template Reservations table for CPU Reservations. Evaluation: Basic 4 GB (for evaluating guest access and basic access policy flows) Advanced 16 GB (for evaluating advanced features such as pxgrid, Internal CA, SXP, Device Administration, and Passive Identity Services) Production: Small 16 GB Large 64 GB Note Refer to the OVA Template Reservations table for Memory Reservations. 59

68 Virtual Machine Requirements Install ISE on a VMware Virtual Machine Requirement Type Hard Disks Specifications Evaluation: Minimum (only for lab testing; supports about 20 endpoints) 100 GB Recommended 200 GB Production: 200 GB to 2 TB of disk storage (size depends on deployment and tasks). We recommend that your VM host server use hard disks with a minimum speed of 10,000 RPM. Note Note When you create the Virtual Machine for Cisco ISE, use a single virtual disk that meets the storage requirement. If you use more than one virtual disk to meet the disk space requirement, the installer may not recognize all the disk space. Refer to the recommended disk space for VMs in the following link: Disk Space Requirements, on page 62. Storage and File System Disk Controller NIC VMware Virtual Hardware Version/Hypervisor The storage system for the Cisco ISE virtual appliance requires a minimum write performance of 50 MB per second and a read performance of 300 MB per second. Deploy a storage system that meets these performance criteria and is supported by VMware server. Cisco ISE provides a number of methods to verify if your storage system meets these minimum requirements before, during, and after Cisco ISE installation. See Virtual Machine Resource and Performance Checks, on page 64 for more information. We recommend the VMFS file system because it is most extensively tested, but other file systems, transports, and media can also be deployed provided they meet the above requirements. Paravirtual (default for RHEL 7 64-bit) or LSI Logic Parallel For best performance and redundancy, a caching RAID controller is recommended. Controller options such as RAID 10 (also known as 1+0) can offer higher overall write performance and redundancy than RAID 5, for example. Additionally, battery-backed controller cache can significantly improve write operations. 1 GB NIC interface required (two or more NICs are recommended; six NICs are supported). Cisco ISE supports E1000 and VMXNET3 adapters. Note We recommend that you select E1000 to ensure correct adapter order by default. If you choose VMXNET3, you might have to remap the ESXi adapter to synchronize it with the ISE adapter order. VMware Virtual Machine Hardware Version 8 or higher on ESXi 5.x and 6.x. 60

69 Install ISE on a VMware Virtual Machine Virtual Machine Appliance Size Recommendations Virtual Machine Appliance Size Recommendations When sizing the Cisco ISE deployment, see the Deployment Size and Scaling Recommendations, on page 9 section for details on the number and size of appliances required for your deployment. The virtual machine (VM) appliance specifications should be comparable with physical appliances run in a production environment. The following table provides the minimum resources required to size your virtual appliance comparable to that of an SNS-3515 or SNS-3595 physical appliance. Keep the following guidelines in mind when allocating resources for the appliance: Failure to allocate the specified resources might result in performance degradation or service failure. We highly recommend that you deploy dedicated VM resources and not share or oversubscribe resources across multiple guest VMs. Deploying Cisco ISE virtual appliances using the OVF templates ensures that adequate resources are assigned to each VM. If you do not use OVF templates, then ensure that you assign the equivalent resource reservations when you manually install Cisco ISE using the ISO image. Note If you choose to deploy Cisco ISE manually without the recommended reservations, you must assume the responsibility to closely monitor your appliance s resource utilization and increase resources, as needed, to ensure proper health and functioning of the Cisco ISE deployment. Note OVF templates are not applicable for Linux KVM. OVF templates are available only for VMware virtual machines. Policy Service nodes on VMs can be deployed with less disk space than Administration or Monitoring nodes. The minimum disk space for any production Cisco ISE node is 200 GB. See Disk Space Requirements, on page 62 for details on the disk space required for various Cisco ISE nodes and personas. VMs can be configured with 1 to 6 NICs. The recommendation is to allow for 2 or more NICs. Additional interfaces can be used to support various services such as profiling, guest services, or RADIUS. Table 5: Minimum VM Appliance Specifications for a Production Environment Platform Processor Memory Total Disk Space Small VM Appliance (based on SNS-3515) 6 total cores (at 2.0 GHz or above) or a total minimum CPU allocation of MHz. 16 GB 200 GB to 2 TB. See Disk Space Requirements, on page 62 for more information. Large VM Appliance (based on SNS-3595) 8 total cores (at 2.0 GHz or above) or a total minimum CPU allocation of MHz. 64 GB 200 GB to 2 TB. See Disk Space Requirements, on page 62 for more information. 61

70 Disk Space Requirements Install ISE on a VMware Virtual Machine Platform Ethernet NICs Small VM Appliance (based on SNS-3515) Up to 6 Gigabit Ethernet NICs Large VM Appliance (based on SNS-3595) Up to 6 Gigabit Ethernet NICs Disk Space Requirements The following table lists the Cisco ISE disk-space allocation recommended for running a virtual machine in a production deployment. Note Disk size of 2 TB or greater is currently not supported. Ensure that the maximum disk size is less than 2 TB. Table 6: Recommended Disk Space for Virtual Machines ISE Persona Standalone ISE Minimum Disk Space for Evaluation 200 GB Minimum Disk Space for Production 600 GB Recommended Disk Space for Production Maximum Disk Note Additional disk Space space is required to store local debug logs, staging files, and to handle log data during upgrade, when the Primary Administration Node temporarily becomes a Monitoring node. 600 GB to 2 TB 2 TB Distributed ISE Administration only 200 GB 250 GB 250 to 300 GB 2 TB Distributed ISE Monitoring only 200 GB 600 GB 600 GB to 2 TB 2 TB Distributed ISE Policy Service only 200 GB 200 GB 200 GB 2 TB Distributed ISE pxgrid only 200 GB 200 GB 200 GB 2 TB 62

71 Install ISE on a VMware Virtual Machine Disk Space Guidelines ISE Persona Distributed ISE Administration and Monitoring (and optionally pxgrid) Minimum Disk Space for Evaluation 200 GB Minimum Disk Space for Production 600 GB Recommended Disk Space for Production Maximum Disk Note Additional disk Space space is required to store local debug logs, staging files, and to handle log data during upgrade, when the Primary Administration Node temporarily becomes a Monitoring node. 600 GB to 2 TB 2 TB Distributed ISE Administration, Monitoring, and Policy Service (and optionally pxgrid) 200 GB 600 GB 600 GB to 2 TB 2 TB Disk Space Guidelines Keep the following guidelines in mind when deciding the disk space for Cisco ISE: You can allocate only up to 2 TB of disk space for a Cisco ISE VM. Cisco ISE must be installed on a single disk in virtual machine. Disk allocation varies based on logging retention requirements. On any node that has the Monitoring persona enabled, 30 percent of the VM disk space is allocated for log storage. A deployment with 25,000 endpoints generates approximately 1 GB of logs per day. For example, if you have a Monitoring node with 600-GB VM disk space, 180 GB is allocated for log storage. If 100,000 endpoints connect to this network every day, it generates approximately 4 GB of logs per day. In this case, you can store 38 days of logs in the Monitoring node, after which you must transfer the old data to a repository and purge it from the Monitoring database. For extra log storage, you can increase the VM disk space. For every 100 GB of disk space that you add, you get 30 GB more for log storage. Depending on your requirements, you can increase the VM disk size up to a maximum of 2 TB of log storage. If you increase the disk size of your virtual machine after initial installation, then you must perform a fresh installation of Cisco ISE on your virtual machine to properly detect and utilize the full disk allocation. 63

72 Virtual Machine Resource and Performance Checks Install ISE on a VMware Virtual Machine The following table lists the number of days that logs can be retained on your Monitoring node based on the allocated disk space and the number of endpoints that connect to your network. The numbers are based on having log suppression and anomalous client detection enabled. Table 7: Days that Logs can be Stored in a Monitoring Node No. of Endpoints 200 GB 600 GB 1024 GB 2048 GB 10, ,289 20, , , , , , , , Virtual Machine Resource and Performance Checks Before installing Cisco ISE on a virtual machine, the installer performs hardware integrity checks by comparing the available hardware resources on the virtual machine with the recommended specifications. During a VM resource check, the installer checks for the hard disk space, number of CPU cores allocated to the VM, CPU clock speed, and RAM allocated to the VM. If the VM resources do not meet the basic evaluation specifications, the installation aborts. This resource check is applicable only for ISO-based installations. When you run the Setup program, a VM performance check is done, where the installer checks for disk I/O performance. If the disk I/O performance does not meet the recommended specifications, a warning appears on screen, but it allows you to continue with the installation. This performance verification check is applicable for both ISO-based and OVA (VMware) installations. The VM performance check is done periodically (every hour) and the results are averaged for a day. If the disk I/O performance does not meet the recommended specification, an alarm is generated. The VM performance check can also be done on demand from the Cisco ISE CLI using the show tech-support command. The VM resource and performance checks can be run independent of Cisco ISE installation. You can perform this test from the Cisco ISE boot menu. 64

73 Install ISE on a VMware Virtual Machine On Demand Virtual Machine Performance Check Using the Show Tech Support Command On Demand Virtual Machine Performance Check Using the Show Tech Support Command You can run the show tech-support command from the CLI to check the VM performance at any point of time. The output of this command will be similar to the following: ise-vm123/admin# show tech begin "disk IO perf" Measuring disk IO performance ***************************************** Average I/O bandwidth writing to disk device: 48 MB/second Average I/O bandwidth reading from disk device: 193 MB/second WARNING: VM I/O PERFORMANCE TESTS FAILED! WARNING: The bandwidth writing to disk must be at least 50 MB/second, WARNING: and bandwidth reading from disk must be at least 300 MB/second. WARNING: This VM should not be used for production use until disk WARNING: performance issue is addressed. Disk I/O bandwidth filesystem test, writing 300 MB to /opt: bytes (315 MB) copied, s, 40.3 MB/s Disk I/O bandwidth filesystem read test, reading 300 MB from /opt: bytes (315 MB) copied, s, 755 MB/s Virtual Machine Resource Check from the Cisco ISE Boot Menu You can check for virtual machine resources independent of Cisco ISE installation from the boot menu. The CLI transcript appears as follows: Cisco ISE Installation (Serial Console) Cisco ISE Installation (Keyboard/Monitor) System Utilities (Serial Console) System Utilities (Keyboard/Monitor) Use the arrow keys to select System Utilities (Serial Console) or System Utilities (Keyboard/Monitor) and press Enter. The following screen appears: Available System Utilities: [1] Recover administrator password [2] Virtual Machine Resource Check [3] Perform System Erase [q] Quit and reload Enter option [1-3] q to Quit Enter 2 to check for VM resources. The output will be similar to the following: ***** ***** Virtual Machine host detected ***** Hard disk(s) total size detected: 322 Gigabyte ***** Physical RAM size detected: Kbytes ***** Number of network interfaces detected: 1 ***** Number of CPU cores: 2 ***** CPU Mhz: ***** Verifying CPU requirement ***** Verifying RAM requirement ***** Writing disk partition table 65

74 Obtain the Cisco ISE Evaluation Software Install ISE on a VMware Virtual Machine Obtain the Cisco ISE Evaluation Software To obtain the Cisco ISE evaluation software (R-ISE-EVAL-K9=), contact your Cisco Account Team or your Authorized Cisco Channel Partner. To migrate a Cisco ISE configuration from an evaluation system to a fully licensed production system, you need to complete the following tasks: Back up the configuration of the evaluation version. Ensure that your production VM has the required amount of disk space. See Deployment Size and Scaling Recommendations, on page 9 for details. Install a production deployment license. Restore the configuration to the production system. Note For evaluation, the minimum allocation requirements for a hard disk on a VM is 200 GB. When you move the VM to a production environment that supports a larger number of users, be sure to reconfigure the Cisco ISE installation to the recommended minimum disk size or higher (up to the allowed maximum of 2 TB). Before You Begin For evaluation purposes, Cisco ISE can be installed on any supported VMs that complies with the VM requirements. When evaluating Cisco ISE, you can configure less disk space in the VM, but you must allocate a minimum disk space of 200 GB. Step 1 Step 2 Go to You must already have valid Cisco.com login credentials to access this link. Click Download Software for this Product. The software image comes with a 90-days evaluation license already installed, so you can begin evaluating all Cisco ISE services when the installation and initial configuration are complete. Install Cisco ISE on Virtual Machines You can install Cisco ISE on VMs in any one of the following ways. We recommend that you download and deploy Cisco ISE OVA templates. Deploy Cisco ISE on Virtual Machines Using OVA Templates, on page 67 Install Cisco ISE on Virtual Machines Using the ISO File, on page 67 Clone a Cisco ISE Virtual Machine, on page 74 66

75 Install ISE on a VMware Virtual Machine Deploy Cisco ISE on Virtual Machines Using OVA Templates Deploy Cisco ISE on Virtual Machines Using OVA Templates You can use OVA templates to install and deploy Cisco ISE software on a virtual machine. Download the OVA template from Cisco.com. Before You Begin You can use OVA templates to install and deploy Cisco ISE software on a virtual machine Note The ISE OVA templates are not compatible with VMware web client for vcenter 6.5. As a workaround, use the VMware OVF tool to import the OVA templates. You must reimage Cisco ISE from ISO if the virtual hard disk is resized after importing the OVA, as Cisco ISE does not support resizing hard disk and file systems after installation. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Open VMware vsphere client. Log in to VMware host. Choose File > Deploy OVF Template from the VMware vsphere Client. Click Browse to select the OVA template, and click Next. Confirm the details in the OVF Template Details page, and click Next. Enter a name for the virtual machine in the Name and Location page to uniquely identify it, and click Next. Choose a data store to host the OVA. Click the Thick Provision radio button in the Disk Format page, and click Next. Cisco ISE supports both thick and thin provisioning. However, we recommend that you choose thick provisioning for better performance, especially for Monitoring nodes. If you choose thin provisioning, operations such as upgrade, backup and restore, and debug logging that require more disk space might be impacted during initial disk expansion. Verify the information in the Ready to Complete page. Check the Power on after deployment check box. Click Finish. Related Topics Virtual Machine Requirements, on page 59 Virtual Machine Appliance Size Recommendations, on page 61 Support for Open Virtualization Format, on page 58 Install Cisco ISE on Virtual Machines Using the ISO File To install Cisco ISE on a VM using the ISO file: Before You Begin Ensure that you read and allocate VM resources according to the requirements specified in this chapter. 67

76 Install Cisco ISE on Virtual Machines Using the ISO File Install ISE on a VMware Virtual Machine Ensure that you have read the Prerequisites for Configuring a VMware ESXi Server, on page 68 section. Download the Cisco ISE ISO image from Cisco.com. Step 1 Configure a VMware server. See Configure a VMware Server, on page 71. Step 2 Configure a VMware system to boot from a software DVD. See Configure a VMware System to Boot From a Cisco ISE Software DVD, on page 72. Related Topics Virtual Machine Requirements, on page 59 Virtual Machine Appliance Size Recommendations, on page 61 Cisco ISE ISO Installation on Virtual Machine Fails, on page 74 Prerequisites for Configuring a VMware ESXi Server Review the following configuration prerequisites listed in this section before you attempt to configure a VMWare ESXi server: Remember to log in to the ESXi server as a user with administrative privileges (root user). Cisco ISE is a 64-bit system. Before you install a 64-bit system, ensure that Virtualization Technology (VT) is enabled on the ESXi server. You must also ensure that your guest operating system type is set to Red Hat Enterprise Linux 7 (64-bit). For Red Hat Enterprise Linux 7, the default NIC type is VMXNET3 Adapter. You can add up to six NICs for your Cisco ISE virtual machine, but ensure that you choose the same Adapter for all the NICs. Cisco ISE supports the E1000 Adapter. 68

77 Install ISE on a VMware Virtual Machine Install Cisco ISE on Virtual Machines Using the ISO File Note If you choose the default network driver (VMXNET3 ) as the Network Adapter, check the physical adapter mappings. Ensure that you map the Cisco ISE GigabitEthernet 0 interface to the 4th interface (NIC 4) in ESXi server as listed in the following table. ADE-OS Cisco ISE E1000 VMXNET3 eth0 GE0 1 4 eth1 GE1 2 1 eth2 GE2 3 2 eth3 GE3 4 3 eth4 GE4 5 5 eth5 GE5 6 6 If you choose the E1000 Adapter, by default, the ESXi adapters and Cisco ISE adapters are mapped correctly. Ensure that you allocate the recommended amount of disk space on the VMware virtual machine. See the Disk Space Requirements, on page 62 section for more information. If you have not created a VMware virtual machine file system (VMFS), you must create one to support the Cisco ISE virtual appliance. The VMFS is set for each of the storage volumes configured on the VMware host. For VMFS5, the 1-MB block size supports up to 2 TB virtual disk size. Virtualization Technology Check If you have an ESXi server installed already, you can check if VT is enabled on it without rebooting the machine. To do this, use the esxcfg-info command. Here is an example: ~ # esxcfg-info grep "HV Support" ----HV Support World Command Line...grep HV Support If HV Support has a value of 3, then VT is enabled on the ESXi server and you can proceed with the installation. If HV Support has a value of 2, then VT is supported, but not enabled on the ESXi server. You must edit the BIOS settings and enable VT on the server. 69

78 Install Cisco ISE on Virtual Machines Using the ISO File Install ISE on a VMware Virtual Machine Enable Virtualization Technology on an ESXi Server You can reuse the same hardware that you used for hosting a previous version of Cisco ISE virtual machine. However, before you install the latest release, you must enable Virtualization Technology (VT) on the ESXi server. Step 1 Step 2 Step 3 Step 4 Step 5 Reboot the appliance. Press F2 to enter setup. Choose Advanced > Processor Configuration. Select Intel(R) VT and enable it. Press F10 to save your changes and exit. Configure VMware Server Interfaces for the Cisco ISE Profiler Service Configure VMware server interfaces to support the collection of Switch Port Analyzer (SPAN) or mirrored traffic to a dedicated probe interface for the Cisco ISE Profiler Service. Step 1 Step 2 Step 3 Choose Configuration > Networking > Properties > VMNetwork (the name of your VMware server instance)vmswitch0 (one of your VMware ESXi server interfaces) Properties Security. In the Policy Exceptions pane on the Security tab, check the Promiscuous Mode check box. In the Promiscuous Mode drop-down list, choose Accept and click OK. Repeat the same steps on the other VMware ESXi server interface used for profiler data collection of SPAN or mirrored traffic. Connect to the VMware Server Using the Serial Console Step 1 Step 2 Step 3 Step 4 Step 5 Power down the particular VMware server (for example ISE-120). Right-click the VMware server and choose Edit. Click Add on the Hardware tab. Choose Serial Port and click Next. In the Serial Port Output area, click the Use physical serial port on the host or the Connect via Network radio button and click Next. If you choose the Connect via Network option, you must open the firewall ports over the ESXi server. If you select the Use physical serial port on the host, choose the port. You may choose one of the following two options: 70

79 Install ISE on a VMware Virtual Machine Install Cisco ISE on Virtual Machines Using the ISO File /dev/ttys0 (In the DOS or Windows operating system, this will appear as COM1). /dev/ttys1 (In the DOS or Windows operating system, this will appear as COM2). Step 6 Step 7 Step 8 Click Next. In the Device Status area, check the appropriate check box. The default is Connected. Click OK to connect to the VMware server. Configure a VMware Server Before You Begin Ensure that you have read the details in the Prerequisites for Configuring a VMware ESXi Server, on page 68 section. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 Log in to the ESXi server. In the VMware vsphere Client, in the left pane, right-click your host container and choose New Virtual Machine. In the Configuration dialog box, choose Custom for the VMware configuration and click Next. Enter a name for the VMware system and click Next. Tip Tip Use the hostname that you want to use for your VMware host. Choose a datastore that has the recommended amount of space available and click Next. (Optional) If your VM host or cluster supports more than one VMware virtual machine version, choose a Virtual Machine version such as Virtual Machine Version 7, and click Next. Choose Linux and Red Hat Enterprise Linux 7 from the Version drop-down list. Choose 2 from the Number of virtual sockets and the Number of cores per virtual socket drop-down list. Total number of cores should be 4. (Optional; appears in some versions of ESXi server. If you see only the Number of virtual processors, choose 4). Choose the amount of memory and click Next. Choose the E1000 NIC driver from the Adapter drop-down list and click Next. The SCSI controller dialog box appears. Choose Paravirtual as the SCSI controller and click Next. Choose Create a new virtual disk and click Next. In the Disk Provisioning dialog box, click Thick Provision radio button, and click Next to continue. Cisco ISE supports both thick and thin provisioning. However, we recommend that you choose thick provisioning for better performance, especially for Monitoring nodes. If you choose thin provisioning, operations such as upgrade, backup and restore, and debug logging that require more disk space might be impacted during initial disk expansion. 71

80 Install Cisco ISE on Virtual Machines Using the ISO File Install ISE on a VMware Virtual Machine Step 14 Step 15 Step 16 Uncheck the Support clustering features such as Fault Tolerance check box. Choose the advanced options, and click Next. Verify the configuration details, such as Name, Guest OS, CPUs, Memory, and Disk Size of the newly created VMware system. You must see the following values: Guest OS Red Hat Enterprise Linux 7 CPUs 6 Memory 16 GB or MB Disk Size 200 GB to 2 TB based on the recommendations for VMware disk space For the Cisco ISE installation to be successful on a virtual machine, ensure that you adhere to the recommendations given in this document. Step 17 Click Finish. The VMware system is now installed. What to Do Next To activate the newly created VMware system, right-click VM in the left pane of your VMware client user interface and choose Power > Power On. Increase Virtual Machine Power On Boot Delay Configuration On a VMware virtual machine, the boot delay by default is set to 0. You can change this boot delay to help you choose the boot options (while resetting the Administrator password, for example). Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 From the VSphere client, right click the VM and choose Edit Settings. Click the Options tab. Choose Advanced > Boot Options. From the Power on Boot Delay area, select the time in milliseconds to delay the boot operation. Check the check box in the Force BIOS Setup area to enter into the BIOS setup screen when the VM boots the next time. Click OK to save your changes. Configure a VMware System to Boot From a Cisco ISE Software DVD After configuring the VMware system, you are ready to install the Cisco ISE software. To install the Cisco ISE software from a DVD, you need to configure the VMware system to boot from it. This requires the VMware system to be configured with a virtual DVD drive. 72

81 Install ISE on a VMware Virtual Machine Install Cisco ISE on Virtual Machines Using the ISO File Before You Begin You must download the Cisco ISE ISO, burn the ISO image on a DVD, and use it to install Cisco ISE on the virtual machine. Step 1 In the VMware client, highlight the newly created VMware system and choose Edit Virtual Machine Settings. Step 2 In the Virtual Machine Properties dialog box, choose CD/DVD Drive 1. Step 3 Step 4 Click the Host Device radio button and choose the DVD host device from the drop-down list. Choose the Connect at Power On option and click OK to save your settings. You can now use the DVD drive of the VMware ESXi server to install the Cisco ISE software. What to Do Next After you complete this task, click the Console tab in the VMware client user interface, right-click VM in the left pane, choose Power, and choose Reset to restart the VMware system. Install Cisco ISE Software on a VMware System Before You Begin After installation, if you do not install a permanent license, Cisco ISE automatically installs a 90-day evaluation license that supports a maximum of 100 endpoints. Download the Cisco ISE software from the Cisco Software Download Site at US/products/ps11640/index.html and burn it on a DVD. You will be required to provide your Cisco.com credentials. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Log in to the VMware client. For the virtual machine to enter the BIOS setup mode, right click the VM and click Edit Settings. Click the Options tab. Select Boot Options and configure the following option: a) In the Force BIOS Setup area, check the check box to enter the BIOS setup screen when the virtual machine boots. Click OK. Ensure that the Coordinated Universal Time (UTC) and the correct boot order is set in BIOS: a) If the virtual machine is turned on, turn the system off. b) Turn on the virtual machine. The system enters the BIOS setup mode. c) In the Main BIOS menu, using the arrow keys, navigate to the Date and Time field and press Enter. d) Enter the UTC/Greenwich Mean Time (GMT) time zone. This time zone setting ensures that the reports, logs, and posture-agent log files from the various nodes in your deployment are always synchronized with regard to the time stamps. 73

82 Clone a Cisco ISE Virtual Machine Install ISE on a VMware Virtual Machine e) Using the arrow keys, navigate to the Boot menu and press Enter. f) Using the arrow keys, select CD-ROM Drive and press + to move the CD-ROM drive up the order. g) Using the arrow keys, navigate to the Exit menu and choose Exit Saving Changes. h) Choose Yes to save the changes and exit. Step 7 Insert the Cisco ISE software DVD into the VMware ESXi host CD/DVD drive and turn on the virtual machine. When the DVD boots, the console displays: Step 8 Step 9 Cisco ISE Installation (Serial Console) Cisco ISE Installation (Keyboard/Monitor) System Utilities (Serial Console) System Utilities (Keyboard/Monitor) Use the arrow keys to select Cisco ISE Installation (Serial Console) or Cisco ISE Installation (Keyboard/Monitor) and press Enter. If you choose the serial console option, you should have a serial console set up on your virtual machine. Refer to the VMware vsphere Documentation for information on how to create a console. The installer starts the installation of the Cisco ISE software on the VMware system. Allow 20 minutes for the installation process to complete. When the installation process finishes, the virtual machine reboots automatically. When the VM reboots, the console displays: Type 'setup' to configure your appliance localhost: At the system prompt, type setup and press Enter. The Setup Wizard appears and guides you through the initial configuration. Cisco ISE ISO Installation on Virtual Machine Fails If a fresh installation of Cisco ISE on a virtual machine fails, and you have the default network driver (VMXNET3 ) chosen as the Network Adapter, check the physical adapter mappings. Ensure that you map the Cisco ISE GigabitEthernet 0 interface to the 6th interface (NIC 6) in ESXi. The workaround is to use the E1000 driver as the Network Adapter. Clone a Cisco ISE Virtual Machine You can clone a Cisco ISE VMware virtual machine (VM) to create an exact replica of a Cisco ISE node. For example, in a distributed deployment with multiple Policy Service nodes (PSNs), VM cloning helps you deploy the PSNs quickly and effectively. You do not have to install and configure the PSNs individually. You can also clone a Cisco ISE VM using a template. Note For cloning, you need VMware vcenter. Cloning must be done before you run the Setup program. Before You Begin Ensure that you shut down the Cisco ISE VM that you are going to clone. In the vsphere client, right-click the Cisco ISE VM that you are about to clone and choose Power > Shut Down Guest. 74

83 Install ISE on a VMware Virtual Machine Clone a Cisco ISE Virtual Machine Ensure that you change the IP Address and Hostname of the cloned machine before you power it on and connect it to the network. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Log in to the ESXi server as a user with administrative privileges (root user). VMware vcenter is required to perform this step. Right-click the Cisco ISE VM you want to clone, and click Clone. Enter a name for the new machine that you are creating in the Name and Location dialog box and click Next. This is not the hostname of the new Cisco ISE VM that you are creating, but a descriptive name for your reference. Select a Host or Cluster on which you want to run the new Cisco ISE VM and click Next. Select a datastore for the new Cisco ISE VM that you are creating and click Next. This datastore could be the local datastore on the ESXi server or a remote storage. Ensure that the datastore has enough disk space. Click the Same format as source radio button in the Disk Format dialog box and click Next. This option copies the same format that is used in the Cisco ISE VM that you are cloning this new machine from. Click the Do not customize radio button in the Guest Customization dialog box and click Next. Click Finish. What to Do Next Change the IP Address and Hostname of a Cloned Virtual Machine Connect a Cloned Cisco Virtual Machine to the Network Related Topics Virtual Machine Requirements, on page 59 Virtual Machine Appliance Size Recommendations, on page 61 Clone a Cisco ISE Virtual Machine Using a Template If you are using vcenter, then you can use a VMware template to clone a Cisco ISE virtual machine (VM). You can clone the Cisco ISE node to a template and use that template to create multiple new Cisco ISE nodes. Cloning a virtual machine using a template is a two-step process: 75

84 Clone a Cisco ISE Virtual Machine Install ISE on a VMware Virtual Machine Before You Begin Note For cloning, you need VMware vcenter. Cloning must be done before you run the Setup program. Step 1 Create a Virtual Machine Template, on page 76 Step 2 Deploy a Virtual Machine Template, on page 77 Create a Virtual Machine Template Before You Begin Ensure that you shut down the Cisco ISE VM that you are going to clone. In the vsphere client, right-click the Cisco ISE VM that you are about to clone and choose Power > Shut Down Guest. We recommend that you create a template from a Cisco ISE VM that you have just installed and not run the setup program on. You can then run the setup program on each of the individual Cisco ISE nodes that you have created and configure IP address and hostnames individually. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Log in to the ESXi server as a user with administrative privileges (root user). VMware vcenter is required to perform this step. Right-click the Cisco ISE VM that you want to clone and choose Clone > Clone to Template. Enter a name for the template, choose a location to save the template in the Name and Location dialog box, and click Next. Choose the ESXi host that you want to store the template on and click Next. Choose the datastore that you want to use to store the template and click Next. Ensure that this datastore has the required amount of disk space. Click the Same format as source radio button in the Disk Format dialog box and click Next. The Ready to Complete dialog box appears. Click Finish. 76

85 Install ISE on a VMware Virtual Machine Clone a Cisco ISE Virtual Machine Deploy a Virtual Machine Template After you create a virtual machine template, you can deploy it on other virtual machines (VMs). Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Right-click the Cisco ISE VM template that you have created and choose Deploy Virtual Machine from this template. Enter a name for the new Cisco ISE node, choose a location for the node in the Name and Location dialog box, and click Next. Choose the ESXi host where you want to store the new Cisco ISE node and click Next. Choose the datastore that you want to use for the new Cisco ISE node and click Next. Ensure that this datastore has the required amount of disk space. Click the Same format as source radio button in the Disk Format dialog box and click Next. Click the Do not customize radio button in the Guest Customization dialog box. The Ready to Complete dialog box appears. Check the Edit Virtual Hardware check box and click Continue. The Virtual Machine Properties page appears. Choose Network adapter, uncheck the Connected and Connect at power on check boxes, and click OK. Click Finish. You can now power on this Cisco ISE node, configure the IP address and hostname, and connect it to the network. What to Do Next Change the IP Address and Hostname of a Cloned Virtual Machine Connect a Cloned Cisco Virtual Machine to the Network Change the IP Address and Hostname of a Cloned Virtual Machine After you clone a Cisco ISE virtual machine (VM), you have to power it on and change the IP address and hostname. Before You Begin Ensure that the Cisco ISE node is in the standalone state. 77

86 Clone a Cisco ISE Virtual Machine Install ISE on a VMware Virtual Machine Ensure that the network adapter on the newly cloned Cisco ISE VM is not connected when you power on the machine. Uncheck the Connected and Connect at power on check boxes. Otherwise, if this node comes up, it will have the same IP address as the source machine from which it was cloned. Figure 19: Disconnecting the Network Adapter Ensure that you have the IP address and hostname that you are going to configure for the newly cloned VM as soon as you power on the machine. This IP address and hostname entry should be in the DNS server. You cannot use "localhost" as the hostname for a node. Ensure that you have certificates for the Cisco ISE nodes based on the new IP address or hostname. Procedure Step 1 Step 2 Step 3 Step 4 Right-click the newly cloned Cisco ISE VM and choose Power > Power On. Select the newly cloned Cisco ISE VM and click the Console tab. Enter the following commands on the Cisco ISE CLI: configure terminal hostname hostname The hostname is the new hostname that you are going to configure. The Cisco ISE services are restarted. Enter the following commands: interface gigabit 0 ip address ip_address netmask The ip_address is the address that corresponds to the hostname that you entered in step 3 and netmask is the subnet mask of the ip_address. The system will prompt you to restart the Cisco ISE services. Refer to the Cisco Identity Services Engine CLI Reference Guide, for the ip address and hostname commands. 78

87 Install ISE on a VMware Virtual Machine Migrate Cisco ISE VM from Evaluation to Production Step 5 Enter Y to restart Cisco ISE services. Connect a Cloned Cisco Virtual Machine to the Network After you power on and change the ip address and hostname, you must connect the Cisco ISE node to the network. Step 1 Step 2 Step 3 Step 4 Right-click the newly cloned Cisco ISE virtual machine (VM) and click Edit Settings. Click Network adapter in the Virtual Machine Properties dialog box. In the Device Status area, check the Connected and Connect at power on check boxes. Click OK. Migrate Cisco ISE VM from Evaluation to Production After evaluating the Cisco ISE release, you can migrate the from an evaluation system to a fully licensed production system. Before You Begin When you move the VMware server to a production environment that supports a larger number of users, be sure to reconfigure the Cisco ISE installation to the recommended minimum disk size or higher (up to the allowed maximum of 2 TB). Please not that you cannot migrate data to a production VM from a VM created with less than 200 GB of disk space. You can only migrate data from VMs created with 200 GB or more disk space to a production environment. Step 1 Step 2 Step 3 Step 4 Back up the configuration of the evaluation version. Ensure that your production VM has the required amount of disk space. Install a production deployment license. Restore the configuration to the production system. 79

88 Migrate Cisco ISE VM from Evaluation to Production Install ISE on a VMware Virtual Machine 80

89 CHAPTER 4 Install Cisco ISE on a Linux KVM KVM Hypervisor Support, page 81 Obtain the Cisco ISE Evaluation Software, page 83 Install Cisco ISE on KVM, page 84 KVM Hypervisor Support Cisco ISE supports KVM hypervisor on Red Hat Enterprise Linux (RHEL) 7.0. KVM Virtualization Check KVM virtualization requires virtualization support from the host processor; Intel VT-x for Intel processors and AMD-V for AMD processors. Open a terminal window on the host and enter the cat /proc/cpuinfo command. You must see either the vmx or the svm flag. For Intel VT-x: # cat /proc/cpuinfo flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm arat epb xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid For AMD-V: # cat /proc/cpuinfo flags: fpu tsc msr pae mce cx8 apic mtrr mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8_legacy Virtual Machine Resource and Performance Checks Before installing Cisco ISE on a virtual machine, the installer performs hardware integrity checks by comparing the available hardware resources on the virtual machine with the recommended specifications. 81

90 Virtual Machine Resource and Performance Checks Install Cisco ISE on a Linux KVM During a VM resource check, the installer checks for the hard disk space, number of CPU cores allocated to the VM, CPU clock speed, and RAM allocated to the VM. If the VM resources do not meet the basic evaluation specifications, the installation aborts. This resource check is applicable only for ISO-based installations. When you run the Setup program, a VM performance check is done, where the installer checks for disk I/O performance. If the disk I/O performance does not meet the recommended specifications, a warning appears on screen, but it allows you to continue with the installation. This performance verification check is applicable for both ISO-based and OVA (VMware) installations. The VM performance check is done periodically (every hour) and the results are averaged for a day. If the disk I/O performance does not meet the recommended specification, an alarm is generated. The VM performance check can also be done on demand from the Cisco ISE CLI using the show tech-support command. The VM resource and performance checks can be run independent of Cisco ISE installation. You can perform this test from the Cisco ISE boot menu. On Demand Virtual Machine Performance Check Using the Show Tech Support Command You can run the show tech-support command from the CLI to check the VM performance at any point of time. The output of this command will be similar to the following: ise-vm123/admin# show tech begin "disk IO perf" Measuring disk IO performance ***************************************** Average I/O bandwidth writing to disk device: 48 MB/second Average I/O bandwidth reading from disk device: 193 MB/second WARNING: VM I/O PERFORMANCE TESTS FAILED! WARNING: The bandwidth writing to disk must be at least 50 MB/second, WARNING: and bandwidth reading from disk must be at least 300 MB/second. WARNING: This VM should not be used for production use until disk WARNING: performance issue is addressed. Disk I/O bandwidth filesystem test, writing 300 MB to /opt: bytes (315 MB) copied, s, 40.3 MB/s Disk I/O bandwidth filesystem read test, reading 300 MB from /opt: bytes (315 MB) copied, s, 755 MB/s Virtual Machine Resource Check from the Cisco ISE Boot Menu You can check for virtual machine resources independent of Cisco ISE installation from the boot menu. The CLI transcript appears as follows: Cisco ISE Installation (Serial Console) Cisco ISE Installation (Keyboard/Monitor) System Utilities (Serial Console) System Utilities (Keyboard/Monitor) Use the arrow keys to select System Utilities (Serial Console) or System Utilities (Keyboard/Monitor) and press Enter. The following screen appears: Available System Utilities: [1] Recover administrator password [2] Virtual Machine Resource Check [3] Perform System Erase [q] Quit and reload Enter option [1-3] q to Quit 82

91 Install Cisco ISE on a Linux KVM Obtain the Cisco ISE Evaluation Software Enter 2 to check for VM resources. The output will be similar to the following: ***** ***** Virtual Machine host detected ***** Hard disk(s) total size detected: 322 Gigabyte ***** Physical RAM size detected: Kbytes ***** Number of network interfaces detected: 1 ***** Number of CPU cores: 2 ***** CPU Mhz: ***** Verifying CPU requirement ***** Verifying RAM requirement ***** Writing disk partition table Obtain the Cisco ISE Evaluation Software To obtain the Cisco ISE evaluation software (R-ISE-EVAL-K9=), contact your Cisco Account Team or your Authorized Cisco Channel Partner. To migrate a Cisco ISE configuration from an evaluation system to a fully licensed production system, you need to complete the following tasks: Back up the configuration of the evaluation version. Ensure that your production VM has the required amount of disk space. See Deployment Size and Scaling Recommendations, on page 9 for details. Install a production deployment license. Restore the configuration to the production system. Note For evaluation, the minimum allocation requirements for a hard disk on a VM is 200 GB. When you move the VM to a production environment that supports a larger number of users, be sure to reconfigure the Cisco ISE installation to the recommended minimum disk size or higher (up to the allowed maximum of 2 TB). Before You Begin For evaluation purposes, Cisco ISE can be installed on any supported VMs that complies with the VM requirements. When evaluating Cisco ISE, you can configure less disk space in the VM, but you must allocate a minimum disk space of 200 GB. Step 1 Step 2 Go to You must already have valid Cisco.com login credentials to access this link. Click Download Software for this Product. The software image comes with a 90-days evaluation license already installed, so you can begin evaluating all Cisco ISE services when the installation and initial configuration are complete. 83

92 Install Cisco ISE on KVM Install Cisco ISE on a Linux KVM Install Cisco ISE on KVM This procedure explains how to create a KVM on RHEL and install Cisco ISE on it using the Virtual Machine Manager (virt-manager). If you choose to install Cisco ISE through the CLI, enter a command similar to the following one: #virt-install --name=kvm-ise1 --arch=x86_64 --cpu=host --vcpus=2 --ram= os-type=linux --os-variant=rhel6 --hvm --virt-type=kvm --cdrom=/home/admin/desktop/ise spa.x86_64.iso --disk=/home/libvirt-images/kvm-ise1.img,size=100 --network type=direct,model=virtio,source=eth2,source_mode=bridge where ise spa.x86_64.iso is the name of the Cisco ISE ISO image. Before You Begin Download the Cisco ISE ISO image to your local system. Step 1 Step 2 Step 3 Step 4 Step 5 From the virt-manager, click New. The Create a new virtual machine window appears. Click Local install media (ISO media or CDROM), and then click Forward. Click the Use ISO image radio button, click Browse, and select the ISO image from your local system. a) Uncheck the Automatically detect operating system based on install media check box, choose Linux as the OS type, Red Hat Enterprise Linux 7.0 as the Version, and click Forward. Choose the RAM and CPU settings and click Forward. Check the Enable storage for this virtual machine check box and choose the storage settings. a) Click the Select managed or other existing storage radio button. b) Click Browse. c) From the Storage Pools navigation pane on the left, click disk FileSystem Directory. d) Click New Volume. A Create storage volume window appears. e) Enter a name for the storage volume. f) Choose raw from the Format drop-down list. g) Enter the Maximum Capacity. h) Click Finish. i) Choose the volume that you created and click Choose Volume. j) Click Forward. The Ready to begin the installation screen appears. Step 6 Step 7 Check the Customize configuration before install check box. Under Advanced options, choose the macvtap as the source for the interface, choose Bridge in the Source mode drop-down list, and click Finish. a) (Optional) Click Add Hardware to add additional NICs. Choose macvtap as the Network source and virtio as the Device model. 84

93 Install Cisco ISE on a Linux KVM Install Cisco ISE on KVM b) To support RHEL 7, the KVM virtual manager has to support Random Number Generator (RNG) hardware. See the following image for RNG configuration. If you are using the CLI to create a new VM, be sure to include the following setting: Step 8 <rng model='virtio' <backend model='random'>/dev/random</backend> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </rng> c) Click Finish. In the Virtual Machine screen, choose the disk device and under Advanced and Performance Options, choose the following options, and click Apply. Field Disk bus Value VirtIO Cache mode none 85

94 Install Cisco ISE on KVM Install Cisco ISE on a Linux KVM Field IO mode Value native Step 9 Step 10 Step 11 Click Begin Installation to install Cisco ISE on KVM. The Cisco ISE installation boot menu appears. At the system prompt, enter 1 to choose a monitor and keyboard port, or 2 to choose a console port, and press Enter. The installer starts the installation of the Cisco ISE software on the VM. When the installation process finishes, the console displays: Type 'setup' to configure your appliance localhost: At the system prompt, type setup and press Enter. The Setup Wizard appears and guides you through the initial configuration. 86

95 CHAPTER 5 Manage Administrator Accounts CLI-Admin and Web-Based Admin User Right Differences, page 87 CLI Admin Users Creation, page 88 Web-Based Admin Users Creation, page 88 CLI-Admin and Web-Based Admin User Right Differences The username and password that you configure when using the Cisco ISE setup program are intended to be used for administrative access to the Cisco ISE CLI and the Cisco ISE web interface. The administrator that has access to the Cisco ISE CLI is called the CLI-admin user. By default, the username for the CLI-admin user is admin and the password is user-defined during the setup process. There is no default password. You can initially access the Cisco ISE web interface by using the CLI-admin user s username and password that you defined during the setup process. There is no default username and password for a web-based admin. The CLI-admin user is copied to the Cisco ISE web-based admin user database. Only the first CLI-admin user is copied as the web-based admin user. You should keep the CLI- and web-based admin user stores synchronized, so that you can use the same username and password for both admin roles. The Cisco ISE CLI-admin user has different rights and capabilities than the Cisco ISE web-based admin user and can perform other administrative tasks. Table 8: Tasks Performed by CLI-Admin and Web-Based Admin Users Admin User Type Both CLI-Admin and Web-Based Admin Tasks Back up the Cisco ISE application data. Display any system, application, or diagnostic logs on the Cisco ISE appliance. Apply Cisco ISE software patches, maintenance releases, and upgrades. Set the NTP server configuration. 87

96 CLI Admin Users Creation Manage Administrator Accounts Admin User Type CLI-Admin only Tasks Start and stop the Cisco ISE application software. Reload or shut down the Cisco ISE appliance. Reset the web-based admin user in case of a lockout. Access the ISE CLI. CLI Admin Users Creation Cisco ISE allows you to create additional CLI-admin user accounts other than the one you created during the setup process. To protect the CLI-admin user credentials, create the minimum number of CLI-admin users needed to access the Cisco ISE CLI. You can add the CLI-admin user by entering into the configuration mode in the CLI and using the username command. Web-Based Admin Users Creation For first-time web-based access to Cisco ISE system, the administrator username and password is the same as the CLI-based access that you configured during setup. You can add web-based admin users through the user interface itself. 88

97 CHAPTER 6 Post-Installation and Maintenance Tasks Log in to the Cisco ISE Web-Based Interface, page 89 Cisco ISE Configuration Verification, page 90 VMware Tools Installation Verification, page 92 Return Material Authorization, page 93 Reset a Password Due to Administrator Lockout, page 93 Change the IP Address of a Cisco ISE Appliance, page 94 View Installation and Upgrade History, page 95 Perform a System Erase, page 95 Log in to the Cisco ISE Web-Based Interface When you log in to the Cisco ISE web-based interface for the first time, you will be using the preinstalled Evaluation license. Note Caution We recommend that you use the Cisco ISE user interface to periodically reset your administrator login password. For security reasons, we recommend that you log out when you complete your administrative session. If you do not log out, the Cisco ISE web-based web interface logs you out after 30 minutes of inactivity, and does not save any unsubmitted configuration data. Before You Begin The Cisco ISE Admin portal supports the following HTTPS-enabled browsers: Mozilla Firefox version 39 and later Google Chrome version 43 and later Microsoft Internet Explorer 9.x, 10.x and 11.x 89

98 Cisco ISE Configuration Verification Post-Installation and Maintenance Tasks If you are using Internet Explorer 10.x, enable TLS 1.1 and TLS 1.2, and disable SSL 3.0 and TLS 1.0 (Internet Options > Advanced). Note Adobe Flash Player or above must be installed on the system running the client browser. The minimum required screen resolution to view the Cisco ISE GUI is 1280 x 800 pixels. Step 1 Step 2 Step 3 Step 4 After the Cisco ISE appliance reboot has completed, launch one of the supported web browsers. In the Address field, enter the IP address (or hostname) of the Cisco ISE appliance by using the following format and press Enter. address or host name>/admin/ Enter a username and password that you defined during setup. Click Login. Cisco ISE Configuration Verification There are two methods that each use a different set of username and password credentials for verifying Cisco ISE configuration by using a web browser and CLI. Note A CLI-admin user and a web-based admin user credentials are different in Cisco ISE. Verify Configuration Using a Web Browser Step 1 Step 2 Step 3 Step 4 After the Cisco ISE appliance reboot has completed, launch one of the supported web browsers. In the Address field, enter the IP address (or host name) of the Cisco ISE appliance using the following format and press Enter. In the Cisco ISE Login page, enter the username and password that you have defined during setup and click Login. For example, entering displays the Cisco ISE Login page. address or host name>/admin/ Note For first-time web-based access to Cisco ISE system, the administrator username and password is the same as the CLI-based access that you configured during setup. Use the Cisco ISE dashboard to verify that the appliance is working correctly. 90

99 Post-Installation and Maintenance Tasks Verify Configuration Using the CLI What to Do Next By using the Cisco ISE web-based user interface menus and options, you can configure the Cisco ISE system to suit your needs. For details on configuring Cisco ISE, see Cisco Identity Services Engine Administrator Guide. Verify Configuration Using the CLI Before You Begin To get the latest Cisco ISE patches and keep Cisco ISE up-to-date, visit the following web site: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 After the Cisco ISE appliance reboot has completed, launch a supported product, such as PuTTY, for establishing a Secure Shell (SSH) connection to a Cisco ISE appliance. In the Host Name (or IP Address) field, enter the hostname (or the IP address in dotted decimal format of the Cisco ISE appliance) and click Open. At the login prompt, enter the CLI-admin username (admin is the default) that you configured during setup and press Enter. At the password prompt, enter the CLI-admin password that you configured during setup (this is user-defined and there is no default) and press Enter. At the system prompt, enter show application version ise and press Enter. Note The Version field lists the currently installed version of Cisco ISE software. The console output appears as shown below: ise-vm123/admin# show application version ise Cisco Identity Services Engine Version : Build Date : Thu Feb 11 07:12: Install Date : Thu Feb 11 15:41: To check the status of the Cisco ISE processes, enter show application status ise and press Enter. The console output appears as shown below: ise-server/admin# show application status ise ISE PROCESS NAME STATE PROCESS ID Database Listener running 5022 Database Server running 44 PROCESSES Application Server running 8369 Profiler Database running 6195 AD Connector running 8926 M&T Session Database running 4528 M&T Log Collector running 8780 M&T Log Processor running 8679 Certificate Authority Service running 8611 SXP Engine Service pxgrid Infrastructure Service disabled 91

100 VMware Tools Installation Verification Post-Installation and Maintenance Tasks pxgrid Publisher Subscriber Service pxgrid Connection Manager pxgrid Controller Identity Mapping Service disabled disabled disabled disabled VMware Tools Installation Verification Verify VMWare Tools Installation Using the Summary Tab in the vsphere Client Go to the Summary tab of the specified VMware host in the vshpere Client. The value in the VMware Tools field should be OK. Figure 20: Verifying VMware Tools in the vsphere Client Verify VMWare Tools Installation Using the CLI You can also verify if the VMware tools are installed using the show inventory command. This command lists the NIC driver information. On a virtual machine with VMware tools installed, VMware Virtual Ethernet driver will be listed in the Driver Descr field. vm36/admin# show inventory NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis" PID: ISE-VM-K9, VID: V01, SN: 8JDCBLIDLJA Total RAM Memory: kb CPU Core Count: 1 92