Monthly Archives: August 2012

Upgrade Cisco ISE 1.0MR NFR to 1.1.1

There is a document that comes with the ISE USB. It is an instruction about how to setup the Cisco Identity Services Engine (ISE) Not-For-Resale partner bundle in an ESXi lab environment and how you can upgrade it from 1.0MR to 1.1. The newest version on Cisco is 1.1.1, so I have followed the instruction and went from 1.0MR to 1.1.1 (aka 1.1MR).

The default VM setting on the ISE 1.0MR is 1 processor and 2GB ram. The ip address of the ISE is 10.10.10.70 and default gateway is 10.10.10.1. Using the predefined username and password given in the document, you will able to get into the CLI as well as the web GUI. (provided your have your virtual network adapter setup correctly for your hosted computer to talk to the virtual machine). In my case, I run the VM on my Hackintoch which using VMware Fusion 3. I have changed the VM setting to 2 processors and 4GB of ram.

To upgrade the ISE NFR form 1.0MR to 1.1.1, the first step is to download the update file from Cisco website. You will need your CCO account to obtain the update software. The file I have downloaded is ise-appbundle-1.1.1.268.i386.gz.

On my Hackintosh, I have enabled the web share and put the downloaded file in the web directory. After that, I log in the ISE by using SSH 10.10.10.70. The CLI of the ISE is similar to the Cisco IOS command, you can do show run to see the running configuration. To prepare for the upgrade, there are some configuration that you need to put in.

ISE/admin# conf t
ISE/admin (config)# repository iseupgrade
ISE/admin (config)# url http://10.10.10.1
ISE/admin (config)# end
ISE/admin# application upgrade ise-appbundle-1.1.1.268.i386.gz iseupgrade

After the install is complete, ISE will reboot. You can use this command “show version” to check the ISE version after the upgrade. It should be showing 1.1.1.268.

The next thing I am going to try is to setup 2 nodes using this NFR kit.

Cisco ISE 1.0 NFR VM

All the new projects I am working on are related to Cisco ISE (Identity Service Engine). To understand this Cisco product better, apart from reading all the documents from cisco.com, I have also purchased the NFR kit from Cisco.

You can purchase a 8GB USB stick from Cisco that contain the ISE 1.0MR Vmware from Cisco Marketplace. The ISE 1.0 NFR kit is free, but the 8GB USB will cost you USD$24.99 + Shipping.

It comes with 20 permanent advanced licenses and you can upgrade this NFR ISE from 1.0 to 1.1.1.

Update: you can upgrade the NFR kit from 1.0 to 1.1.2

Lightroom 4 workshop

I went to a Lightroom 4 Workshop for 2 days and learned something new. Now I know how to apply the filter to bring some light back in some of the area in a photo!

Before

After

Cisco Zone Base Firewall and HSRP

I was working on a project which involved with 2 routers which also act as a firewall. The reason for that is because someone want to replace a standalone Cisco PIX firewall with 2 x routers to improve the availability as well as security.

I really not sure who come up with this idea. It gave me enough headache during the implementation process. The challenges are :
– The zone base firewalls on the routers cannot work in a cluster mode like a Cisco ASA
– The multiple WAN interfaces with EIGRP/OSPF routing process will break the data throw direction
– A stateful failover cannot be setup.

<--more-->

To achieve this setup, I have use EEM script to detect HSRP syslog message for a failure and the EEM script to remove the routing process on the route which the link is failed and enable the routing process on the router that become active.

I have spent a lot of time to work out this “solution”. Provided I have to use the pre-selected hardware to reach the high availability requirement. I believe what I have done is good enough to meet the client’s expectation while they don’t need to buy new hardware. To be honest, they should really get a firewall instead of 2 3900 series routers to work as a firewall.