在ISE上安裝修補程式

簡介

本文檔介紹在安裝過程中安裝ISE修補的方法和常見問題。

必要條件

需求

身份服務引擎(ISE)的基本知識。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

• Cisco Identity Service Engine 2.X

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

背景資訊

思科會以半定期的方式發布 ISE。這些修補程式包含錯誤修正程式，以及必要時的保全性修正程式（例如，使用SSL發現的Heartbleed和Poodle漏洞）。 這可以確保應用錯誤修復、插入安全漏洞，並且解決方案能夠無縫運行。

當您在ISE節點上安裝修補程式時，該節點將重新啟動。安裝完成後，重新啟動服務。請等待幾分鐘，然後再次登入。

您可以在維護時段期間安排修補程式安裝作業，以避免暫時中斷的情況。

僅安裝適用於網路中部署的思科版本的修補程式。思科會報告版本中的任何不符情況以及修補檔案中的任何錯誤。

您不能安裝比思科當前安裝的修補程式版本更低的修補程式。同樣地，如果思科產品上已安裝較新的版本，您便無法復原較舊版本的變更。

當您從屬於分散式部署的 Primary Administration Node (PAN)安裝修補程式時，Cisco ISE會在主節點上安裝修補程式，然後在部署中的所有輔助節點上安裝修補程式。 如果在PAN上成功安裝修補程式，思科ISE將繼續在輔助節點上安裝修補程式。如果PAN上的安裝失敗，則不會繼續進行輔助節點的安裝。 但是，如果出於任何原因而在任何次要節點上安裝失敗，則仍會繼續在部署中的下一個次要節點上進行安裝。

當您從屬於雙節點部署的PAN安裝修補程式時，Cisco會在主節點上安裝修補程式，然後在輔助節點上安裝修補程式。

如果在PAN上成功安裝修補程式，Cisco將在輔助節點上繼續安裝修補程式。如果PAN上的安裝失敗，則安裝不會繼續執行輔助節點。

您必須具有超級管理員或系統管理員的管理員角色，才能安裝或復原修補程式。在修正程式安裝開始之前，收集組態備份與作業備份。

使用GUI安裝修補程式

要從Cisco.com下載ISE修補程式，請導航到 Downloads > Products > Security > Access Control and Policy > Identity Services Engine > Identity Services Engine Software(此處)。

注意：思科ISE修補一般是累積性的，這意味著修補11的安裝包含從修補1到修補10的所有修補。修補程式安裝需要重新啟動ISE伺服器。

注意：在下載修補程式檔案後驗證MD5/SHA512校驗和。

要在ISE上應用修補程式，請登入ISE Primary Administration Node (PAN) GUI並執行以下指令： 

步驟 1.導覽至 Administration > System > Maintenance > Patch Management > Install.

步驟 2.按一下 Browse並選擇從Cisco.com下載的修補程式檔案。

步驟 3.按一下 Install安裝修補程式。

使用CLI進行修補安裝

步驟 1.配置ISE儲存庫，並將所需的ISE修補程式放置在儲存庫中。若要設定 ISE 存放庫，請參閱如何在 ISE 上設定存放庫。

步驟 2.使用SSH登入ISE CLI。

步驟 3.確保ISE CLI可以列出儲存庫內容。

ISE/admin# show repository FTP_repository

ise-patchbundle-10.2.0.7-Patch6-19021923.SPA.x86_64.tar.gz
ise-patchbundle-10.2.0.7-Patch9-19062923.SPA.x86_64.tar.gz
ise-patchbundle-10.1.0.0-Ptach3-19110111.SPA.x86_64.tar.gz

步驟 4.為了從CLI在特定ISE節點上安裝修補程式，請在執行模式下運行 patch install命令。

Patch install 
    
     
    
    

透過 SSH 登入 ISE 節點的 CLI，然後執行下列命令：

ISE/admin#patch install ise-patchbundle-10.1.0.0-Ptach3-19110111.SPA.x86_64.tar.gz FTP_repository
% Warning: Patch installs only on this node. Install with Primary Administration node GUI to install on all nodes in deployment. Continue? (yes/no) [yes] ? yes
Save the current ADE-OS run configuration? (yes/no) [yes] ? yes
Generating configuration...
Saved the ADE-OS run Configuration to startup successfully
Initiating Application Patch installation...

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
patch successfully installed

% This application Install or Upgrade requires reboot, rebooting now...
Broadcast message from root@ISE (pts/1) (Fri Feb 14 01:06:21 2020):
Trying to stop processes gracefully. Reload lasts approximately 3 mins
Broadcast message from root@ISE (pts/1) (Fri Feb 14 01:06:21 2020):
Trying to stop processes gracefully. Reload takes approximately 3 mins
Broadcast message from root@ISE (pts/1) (Fri Feb 14 01:06:41 2020):
The system is going down for reboot NOW
Broadcast message from root@ISE (pts/1) (Fri Feb 14 01:06:41 2020):
The system is going down for reboot NOW

如何在部署中的所有ISE節點上安裝修補程式

當您從屬於分散式部署的PAN安裝修補程式時，Cisco ISE會在主要節點上安裝修補程式，然後會在部署中的所有輔助節點上安裝修補程式。 如果成功在主要 PAN 上安裝修補程式，Cisco ISE 便會繼續在次要節點上安裝修補程式。如果PAN上的安裝失敗，則不會繼續進行輔助節點的安裝。

但是，如果出於任何原因而在任何次要節點上安裝失敗，則仍會繼續在部署中的下一個次要節點上進行安裝。

如何在部署中的所有ISE節點上回滾修補程式

若要從部署中的 Cisco ISE 節點復原修補程式，您必須先透過 PAN 復原變更。如果成功完成此動作，則修補程式將會從次要節點復原。如果 PAN 上的復原程序失敗，則修補程式將不會從次要節點復原。 但是，如果修補程式在任何次要節點上復原失敗，則仍會繼續透過部署中的下一個次要節點來復原修補程式。

在 Cisco ISE 從次要節點復原修補程式時，您可以繼續透過 PAN GUI 執行其他工作。 輔助節點在回滾後重新啟動。

要回滾ISE修補程式，請登入 ISE GUI，導航到 Administration > System > Maintenance > Patch Management 並選擇所需的修補程式並 Rollback,按一下如圖所示：

如何從ISE CLI回滾修補程式

步驟 1. 透過SSH連線到要刪除修補程式的ISE節點。

步驟 2.使用命令驗證ISE節點上安裝的修補程式  Show Version

ISE/admin# show version

Cisco Application Deployment Engine OS Release: 3.0
ADE-OS Build Version: 3.0.5.144
ADE-OS System Architecture: x86_64
Copyright (c) 2005-2019 by Cisco Systems, Inc.
All rights reserved.
Hostname: ISE

Version information of installed applications
---------------------------------------------
Cisco Identity Services Engine
---------------------------------------------
Version : 10.1.0.0
Build Date : Tue Feb 12 00:45:06 2019
Install Date : Mon Sep 30 12:17:29 2019

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 1
Install Date : Tue Oct 01 01:30:12 2019

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 3
Install Date : Tue Mar 24 05:35:19 2020

步驟 3.運行 patch remove命令<application name> <patch file number to be removed> 

            例如：- patch remove ise 2

ISE/admin# patch remove ise 3
Continue with application patch uninstall? [y/n] y
% Warning: Patch is removed only from this node. Remove patch with Primary Administration node GUI to remove from all nodes in deployment.

Patch successfully uninstalled

% This application Install or Upgrade requires reboot, rebooting now...
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:16:29 2020):
Trying to stop processes gracefully. Reload takes approximately 3 mins
Broadcast message from root@ISE (pts/1) (Sun Mar 8  03:16:29 2020):
Trying to stop processes gracefully. Reload takes approximately 3 mins
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:17:41 2020):
The system is going down for reboot NOW
Broadcast message from root@ISE (pts/1) (Sun Mar 8 03:17:41 2020):
The system is going down for reboot NOW

注意：ISE修補在性質上是累積的，當存在更新的版本時無法回滾。較新的版本需要先回滾。

  若要解除安裝先前的修正程式，請先解除安裝最新的修正程式，然後再解除安裝先前的修正程式版本。

ISE/admin#patch remove ise 1
Continue with application patch uninstall? [y/n] y
% Warning: Patch is removed only from this node. Remove patch with Primary Administration node GUI to remove from all nodes in deployment. 
Continue? (yes/no) [yes] ? yes
% Patch cannot be rolled back while a newer version exists, which needs to rolled back first. 

驗證

要檢視ISE修補程式安裝進度，請導航到 Administration > System > Maintenance > Patch Management > Show Node Status，如圖所示：

從ISE節點驗證修補程式安裝狀態。登入到同一ISE伺服器並運行命令 Show Version

ISE1/admin# show version

Cisco Application Deployment Engine OS Release: 3.0
ADE-OS Build Version: 3.0.5.144
ADE-OS System Architecture: x86_64

Copyright (c) 2005-2019 by Cisco Systems, Inc.
All rights reserved.
Hostname: ISE1

Version information of installed applications
---------------------------------------------

Cisco Identity Services Engine
---------------------------------------------
Version : 10.1.0.0
Build Date : Tue Feb 12 06:15:06 2019
Install Date : Thu Nov 21 16:39:02 2019

Cisco Identity Services Engine Patch
---------------------------------------------
Version : 1
Install Date : Thu Apr 02 11:00:08 2020

ISE1/admin#  

驗證ISE警報中的成功和失敗修補程式消息：

修補程式安裝成功記錄參考

isea/admin# sh log system ade/ADE.log tail
2020-04-19T15:38:01.634794+05:30 isea ADEOSJAVAAPI[26999]: ADEAUDIT 2030, type=PATCH INSTALL, name=PATCH INSTALL STARTED, username=kopriadm, cause=Application patch install has been inititated, adminipaddress=10.65.80.116, interface=GUI, 
detail=Patch Install initiated with bundle - ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz, repo - tmplocalpatchinstallrepo
2020-04-19T15:38:01.635194+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[796] [test]: Install initiated with bundle - ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz, repo - tmplocalpatchinsta
llrepo
2020-04-19T15:38:01.784100+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[913] [test]: Stage area - /storeddata/Install/.1587290881
2020-04-19T15:38:01.827925+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[918] [test]: Getting bundle to local machine
2020-04-19T15:38:01.829562+05:30 isea ADE-SERVICE[1158]: [26999]:[error] config:repository: rm_repos_cfg.c[552] [test]: server not found in url
2020-04-19T15:38:01.830656+05:30 isea ADE-SERVICE[1158]: [26999]:[info] transfer: cars_xfer.c[66] [test]: local copy in of ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz requested
2020-04-19T15:38:02.873630+05:30 isea ADE-SERVICE[1158]: [26999]:[info] transfer: cars_xfer_util.c[2293] [test]: Properties file /tmp/.cars_repodownload.props exists need to cleanup after a SIGNAL or download complete
2020-04-19T15:38:03.247065+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[954] [test]: Got bundle at - /storeddata/Install/.1587290881/ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz
2020-04-19T15:38:03.247424+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1002] [test]: Unbundling package ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz
2020-04-19T15:38:09.066295+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1064] [test]: Verifying signature for package ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz
2020-04-19T15:38:13.171615+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1073] [test]: Signed bundle /storeddata/Install/.1587290881/ise-patchbundle-10.1.0.0-Patch3-19110111.SPA.x86_64.tar.gz confirme
d with release key
2020-04-19T15:38:18.816986+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1166] [test]: Unbundling done. Verifying input parameters...
2020-04-19T15:38:18.877267+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1195] [test]: Manifest file is at - /storeddata/Install/.1587290881/manifest.xml
2020-04-19T15:38:18.877604+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1234] [test]: Manifest file appname - ise
2020-04-19T15:38:18.878051+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1286] [test]: Patch bundle contains patch(3) for app version(10.1.0.0)
2020-04-19T15:38:18.878254+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install ci_util.c[305] [test]: Comparing installed app version:(10.1.0.0) and version of app the patch is meant for:(10.1.0.0)
2020-04-19T15:38:18.878517+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1321] [test]: Manifest file pkgtype - CARS
2020-04-19T15:38:18.878712+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1735] [test]: Verifying zip...
2020-04-19T15:38:27.006433+05:30 isea ADE-SERVICE[1158]: [26999]:[info] application:install cars_install.c[1796] [test]: Executing patch install script patchinstall.sh from patch.zip
2020-04-19T15:38:27.209692+05:30 isea test: info:[patchinstall.sh] START PATCH INSTALL SCRIPT. PATCHDIR: /storeddata/Install/.1587290881 INSTALLDIRS: 
2020-04-19T15:38:27.211274+05:30 isea test: info:[patchinstall.sh] NEW PATCH VER: 3 PRIOR PATCH VER: 0 
2020-04-19T15:38:27.213166+05:30 isea test: info:[patchinstall.sh] IRF-RABBITMQ-RUNTIME and IRF-CORE-ENGINE-RUNTIME Remove Begin
2020-04-19T15:38:27.214840+05:30 isea test: info:[patchinstall.sh] Remove IRF-Rabbitmq container
2020-04-19T15:38:27.753502+05:30 isea test: info:[patchinstall.sh] IRF-Rabbitmq container id - 
2020-04-19T15:38:27.755172+05:30 isea test: info:[patchinstall.sh] No IRF-Rabbitmq container exist to remove.\n
2020-04-19T15:38:27.756631+05:30 isea test: info:[patchinstall.sh] Remove IRF-Core-Engine container
2020-04-19T15:38:27.781127+05:30 isea test: info:[patchinstall.sh] IRF-Core-Engine container id - 
2020-04-19T15:38:27.783028+05:30 isea test: info:[patchinstall.sh] No IRF-Core-Engine container exist to remove.\n
2020-04-19T15:38:27.784724+05:30 isea test: info:[patchinstall.sh] IRF-RABBITMQ-RUNTIME and IRF-CORE-ENGINE-RUNTIME Remove Completed
2020-04-19T15:38:33.077501+05:30 isea test: info:[application:operation:cpmcontrol.sh] In Stop Monit
2020-04-19T15:38:33.197734+05:30 isea test: Monit daemon with pid [12796] killed
2020-04-19T15:38:34.289656+05:30 isea test: info:[application:operation:cpmcontrol.sh] Done Stop Monit
2020-04-19T15:38:34.671998+05:30 isea ADEOSShell[28278]: ADEAUDIT 2062, type=USER, name=M&T Log Processor, username=system, cause=M&T Log Processor Stopped, adminipaddress=127.0.0.1, interface=CLI, detail=Stopping M&T Log Processor
2020-04-19T15:38:43.621160+05:30 isea test: info:[application:operation:adprobe.sh] adprobe:Stopping wmi probe...
2020-04-19T15:38:43.657769+05:30 isea test: info:[application:operation:adprobe.sh] adprobe:wmi probe is disabled
2020-04-19T15:38:43.989085+05:30 isea test: info:[application:operation:syslogprobe.sh] syslogprobe:Stopping syslog probe...
2020-04-19T15:38:44.019674+05:30 isea test: info:[application:operation:syslogprobe.sh] syslogprobe:syslog probe is disabled
2020-04-19T15:38:44.367442+05:30 isea test: info:[application:operation:restprobe.sh] restprobe:Stopping rest probe...
2020-04-19T15:38:44.400103+05:30 isea test: info:[application:operation:restprobe.sh] restprobe:rest probe is disabled
2020-04-19T15:38:44.713844+05:30 isea test: info:[application:operation:agentprobe.sh] agentprobe:Stopping agent probe...
2020-04-19T15:38:44.753547+05:30 isea test: info:[application:operation:agentprobe.sh] agentprobe:agent probe is disabled
2020-04-19T15:38:46.166418+05:30 isea test: info:[application:operation:appservercontrol.sh] Stopping ISE Application Server...
2020-04-19T15:38:46.168374+05:30 isea ADEOSShell[29231]: ADEAUDIT 2062, type=USER, name=Application server status, username=system, cause=Application server stopped, adminipaddress=127.0.0.1, interface=CLI, detail=Application server stopped

2020-04-19T15:41:37.224949+05:30 isea test: info:[patchinstall.sh] ISE 10.1.0.0 patch 3 installFileSystem() INVOKED
2020-04-19T15:41:37.245321+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/xde/xdeRuntime/packages/std/WorkflowsProject.xar 
2020-04-19T15:41:37.251672+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/bin/ctl/radius_auth.ctl 
2020-04-19T15:41:37.258874+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/report-definitionsV2/Audit/Internal-Administrator-Summary.xml 
2020-04-19T15:41:37.265939+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/report-definitionsV2/Endpoints and Users/Posture-Assessment-by-Endpoint.xml 
2020-04-19T15:41:37.273866+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/report-definitionsV2/Endpoints and Users/Posture-Assessment-by-Condition.xml 
2020-04-19T15:41:37.280143+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/lib/mnt-collection.jar 
2020-04-19T15:41:37.288008+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/mnt/lib/libJniCollector.so 
2020-04-19T15:41:37.295128+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/appsrv/apache-tomcat-ca-8.5.32/apr/lib/libapr-1.a 
2020-04-19T15:41:37.302031+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/appsrv/apache-tomcat-ca-8.5.32/apr/lib/libtcnative-1.a 
2020-04-19T15:41:37.308615+05:30 isea test: info:[patchinstall.sh] Updating patched file: /storeddata/Install/.1587290881/filesystem/opt/CSCOcpm/appsrv/apache-tomcat-ca-8.5.32/webapps/ocsp-responder-webapp/WEB-INF/lib/import-export-2.6
.0-156.jar

Broadcast message from root@isea (Sun Apr 19 15:50:40 2020):

Trying to stop processes gracefully. Reload takes approximately 3 mins

Broadcast message from root@isea (Sun Apr 19 15:51:01 2020):

The system is going down for reboot NOW

Session terminated, killing shell... ...killed.