LINICKX.com

Running Cisco ISE (1.4) in VirtualBox

Nick Bettison — Fri, 24 Jul 2015 18:59:00 +0100

I've been meaning to do this for a while, but I've finally hacked Cisco ISE into VirtualBox for home lab learning and experimentation.

For those familiar with my ACS in VirtualBox post you should notice a very similar theme.

Copy the .iso to a Web server directory that allows page indexing
Hack the KickStart file (ks.cfg) to remove Cisco's hardware checks
Boot the install CD using the custom ks.cfg

As before, I use the web installation method because it's the easiest way to hack/test/boot multiple times when you're trying to work out why the installer doesn't run... Also ** I will not be providing you an ISO file to download. **

Web Server Configuration (nginx)

First, I mounted ise-1.4.0.253.x86_64.iso and copied the whole CD to ~/public_html/ise

Next, I need to expose this directory to the web server. I'm using nginx on CentOS... it's nice and easy, I added this to my config.

location /ise {
    root /home/nick/public_html/;
    autoindex on;
}

Replace ks.cfg

When you copy the contents of the CD to the local file system you'll notice all files have the RO flag set. Fix with chmod +w ~/public_html/ise/ks.cfg

There are a few things in the file you need to change:

Replace cdrom on line 10 with url --url http://192.168.10.122/ise/ (replace 192.168.10.122 with the IP of your web server)
Optional, replace the encrypted root password with a new one rootpw CISCO_ise_p455w0rd on line 12
Comment out with a # any /sbin/halt -f statements to stop error messages from halting the installation
Replace any cars_udi_util statements with your own versions, so...

UDI_PID=`/sbin/cars_udi_util -p`
UDI_VID=`/sbin/cars_udi_util -v`
UDI_SN=`/sbin/cars_udi_util -s`

becomes...

UDI_PID="Cisco-VM-SPID"
UDI_VID="1.0"
UDI_SN="123456789"

... and just for good measure, after validate_hwinfo(){ insert (on a new line) UDI_PID="Cisco-VM-SPID" to force hardware selection.

If you want, you can ignore all of that and just use my ks.cfg

VirtualBox Configuration

CPU - 4
RAM - 8Gb
Hard Disk - SCSI - 100Gb (thin space allocation)
CDRom - ise-1.4.0.253.x86_64.iso
NIC 1 - Bridged
NIC 2 - Host Only (disconnected)

All other defaults left alone.

Boot the custom install

Boot the virtual machine from the Cisco ISO, but DO NOT select 1,2,3 or 4. Instead type:

vmlinuz text ks=http://192.168.10.122/ise/ks.cfg initrd=initrd.img

...replacing 192.168.10.122 with your web server IP.

Wait, See, Enjoy!

With a little luck, the VM will load your custom KickStart file and begin the install.

If you tail your web server access logs, you should see stuff like:

192.168.10.116 - - [30/Jun/2015:18:50:49 +0100] "GET /ise/Packages/CARSCmdSched-2.0cars-1.x86_64.rpm HTTP/1.1" 200 28353 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:49 +0100] "GET /ise/Packages/CARSICMPUtil-2.0cars-1.x86_64.rpm HTTP/1.1" 200 11425 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:49 +0100] "GET /ise/Packages/CARSSysMon-2.0cars-1.x86_64.rpm HTTP/1.1" 200 34919 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:49 +0100] "GET /ise/Packages/libdrm-2.4.39-1.el6.x86_64.rpm HTTP/1.1" 200 119408 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:49 +0100] "GET /ise/Packages/plymouth-0.8.3-27.el6.centos.x86_64.rpm HTTP/1.1" 200 91056 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:50 +0100] "GET /ise/Packages/rsyslog-5.8.10-6.el6.x86_64.rpm HTTP/1.1" 200 663780 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"
192.168.10.116 - - [30/Jun/2015:18:50:50 +0100] "GET /ise/Packages/cronie-anacron-1.4.4-7.el6.x86_64.rpm HTTP/1.1" 200 29768 "-" "Cisco Identity Services Engine (anaconda)/1.3" "-"

At the end of the install the VM should reboot into the normal setup login screen allowing you to complete the setup parameters

The setup will take ages, well over the 15/20mins that Cisco suggest but once it completes and reboots you should find you have a working ISE to play with.

... well, for 90days until the eval lic runs out!

RTFM: Aero in Virtualbox

nick — Thu, 08 Mar 2012 07:48:00 +0000

Yes there are loads of "how to enable Aero in Virtualbox" posts out there, but they are all long too long ;)

Install VirtualBox > 4.1
Install Windows 7
Install Guest Additions
- DURING the install, manually select 3D Support
- Select Yes WDDM video driver
- Ignore the warning about safe mode and continue
Reboot
In Control Panel, Personalise re-select the Window7 Default Aero Theme.
Done

References:

F5 BigIP LTM VE works in Virtual Box

nick — Tue, 26 Jul 2011 08:09:00 +0100

Something I discovered ages ago (so long ago that my trial license expired) but forgot to post is that you can get an LTM VE to work in Virtual Box.

To get started download the ESX image from the F5 VE Trial Page, when you get the download import the OVA into virtualbox.

The only thing I needed to tweak after the import was the interface settings, you need two intels and a PCNet, the PCNet is the management interface. Set the PCNet to host only networking, give your laptop/pc an ip address on the host only network a 192.168.1 address and you're good to go!

You may experience HIGH CPU issues after boot, but since these boxes are based on linux, you can use the divider=10 centos trick.

Enjoy your virtual load balancing!

Cisco ACS 5.2 works in VirtualBox

nick — Wed, 02 Mar 2011 18:33:00 +0000

My how to get ACS 5.1 running in VirtualBox is one of my more popular posts; recently I was asked if 5.2 would work, the answer is yes!

I've posted an updated ks.cfg ... if you compare it to the old one the only real difference is an updated set of version numbers, all the other instructions are exactly the same....well, except now centos 4.7 can be found in the vault :)

Next I plan to see if I can make this work in EC2 as I recon a cloud based ACS server would be pretty cool, wish me luck and enjoy the 5.2 goodness!

Lowing VirtualBox priorities

nick — Mon, 14 Feb 2011 17:30:00 +0000

One of the things I'd really like is process priorities for virtual box. In the forum I posted a couple of shell commands that I regularly type... which gets a bit tedious, following a recent article on lifehacker reviewing mac text expanding I've been prompted to automate a few things... below is a little shell script to lower the priority (renice) of all running virtual machines.

The advantage of doing this is that your host machine stays snappy, responsive and won't get too over-loaded by jobs on your VMs!

#!/bin.bash
ps -xo pid,command | grep -v grep | grep startvm | while read line ;
do
        procID=`echo $line | awk '{print $1}'`
        sudo renice +10 -p $procID
done

The above code works on a mac; although I haven't tested it, I recon to get it running on Linux you need to update the PS command, by swapping the x for an e... like this....

#!/bin.bash
ps -eo pid,command | grep -v grep | grep startvm | while read line ;
do
        procID=`echo $line | awk '{print $1}'`
        sudo renice +10 -p $procID
done

Have fun, suggestions and improvements welcome.

Cisco ACS 5.1 in VirtualBox

nick — Fri, 19 Mar 2010 12:07:00 +0000

After much swearing and hackerizing I'm happy to post a screenshot of Cisco's ACS running in VirtualBox :)

Before I explain what I've done, a quick message for "the stupids"

No I won't post a virtual machine for you to download
Buy a license or an appliance

The rest of this post is a run though of what I did, if you get bored easily skip to the summary.

The story is I've got a customer who wants dot1x with ACS5 and I need a box to play with before breaking their network; having read through the docs on cisco.com I noticed that vmware was a supported platform for evaluation, as awesome as that is, carrying around an ESXi server isn't as convenient as you'd think so I boldly dropped the CD into my VirtualBox and booted to see what happened.... if only it was that simple!!!!!

As expected the installer crapped out early on complaining that VirtualBox is not a valid hardware configuration, so I decided to have a poke around the ISO image and had a moment of realisation.. THANK YOU CISCO FOR CHOOSING CENTOS!

Cisco choosing an open-source installation mechanism means that with a bit of googling I could customise the install process to work in VirtualBox.... sweeet!

To get started I followed the install guide to build a VirtualBox appliance that resembled the supported vmware machine, some things to note:

The disk is on a SCSI controller
The processor is PAE
You need a serial port enabled

This is a summary of my VirtualBox configuration...

General
- Name: Cisco ACS 5
- OS Type: Red Hat
System
- Base Memory: 1024 MB
- Processor(s):1
- Boot Order:Floppy, CD/DVD-ROM, Hard Disk
- VT-x/AMD-V:Enabled
- Nested Paging:Enabled
Display
- Video Memory:12 MB
- 3D Acceleration:Disabled
- 2D Video Acceleration:Disabled
- Remote Display Server:Disabled
Storage
- IDE Controller
  IDE Primary Master (CD/DVD):Empty
- Floppy Controller
  Floppy Device 0:Empty
- SCSI Controller
  SCSI Port 0:CiscoACS.vdi (Normal, 65.00 GB)
Misc
- Audio
  Disabled
- Network
  Adapter 1:PCnet-FAST III (Host-only adapter, 'vboxnet0')
- Serial Ports
  Port 1:COM1, Disconnected
- USB
  Disabled
- Shared Folders
  None

If you're hoping to follow my process, I assume you've already downloaded from cisco a copy of the ACS_v5.1.0.44.iso and sorted an eval license.

Looking at the contents of the CD I could see that the KickStart file was rejecting my hardware configuration. In my early attempts I edited ks.cfg removing everything between %pre and %post removed the line that said %include and rebuilt the ISO; this had limited success, I could boot further on my new ISO but found that anaconda crapped out as it was unable to find the CD from which it booted ... Very Odd!

Messing with the kickstart file and having to rebuild the ISO each time got boring very quickly, especially since it wouldn't boot into anaconda stage two. I decided to move to a network based installed, I setup a web server on my laptop, downloaded CentOS-4.7-i386-bin1of4.iso and booted my guest from that using linux askmethod at the loader. On my web server I copied the contents of the ACS CD into a directory (including . hidden files), during the centos boot I was able to install "everything" from the ACS directory on web server giving me yet more limited success (Everything was installed - including the Cisco packages - but unusable).

The next step was to get my web installation to read my kickstart file, the ks.cfg has a load of finalization which looked like it created files that the cisco packages would need. I had to change the permissions of the directory to give me write access (CD files copied as RO since the CD was RO). So my edited ks.cfg has nothing between %pre & %post plus the %include line deleted, the result had massive drawback, I'd inadvertently removed the disk layout; I have since concluded that my earlier attempt with everything installed but broke also had issues due to incorrect filesystem partitions.

To put the filesystem layout back into the kickstart file I inserted the following:

part / --fstype ext3 --size=100 --grow
part /localdisk --fstype ext3 --size=5120
part /recovery --fstype ext3 --size=1008
part /storedconfig --fstype ext3 --size=981
part /storeddata --fstype ext3 --size=2048
part swap --size=2048

To get the Centos Server to now boot from both the kickstart file and install from my webserver I now have to boot with linux ks=http://192.168.56.1/~nick/ACS/ks.cfg (this is instead of linux askmethod) and replace the line that says cdrom with url --url http://192.168.56.1/~nick/ACS.

After all that trial & error I was finally there! I have attached my ks.cfg for your reference and here is a summary of the steps to reproduce.

Install Summary:

Download ACS
Download Centos
Install a web server
Copy the contents of the ACS CD to your web server (look out for .discinfo)
Replace ks.cfg with your edited version (or mine)
Create a virtualbox machine
Boot the VirtualBox machine from the CentOS CD with linux ks=http://URL
As soon as you see a blue "installer" screen eject the CentOS CD
Wait
Done

Note: During my playing the anaconda installer crapped out a couple of times, just starting the process again seemed to fix the issue, some bottleneck on virtualbox disk accesses could be the problem.

Hope that all makes sense, happy hacking!

MacBook Pro UK Keyboard Layout for Windows

nick — Mon, 18 Jan 2010 15:28:00 +0000

I've imported my windows box into VirtualBox (howto) and noticed that the keyboard layout is all screwed up.

My Googling suggests that a German and Swedish bloke/bird/person have fixed this issue but no-one in the UK.

Attached is my UK Keyboard layout, also the source file so you can use microsoft keyboard layout creator to make your own.

To use, simply unzip, run setup, and then in your keyboard settings (control panel) change to "English UK - Apple MacBook Pro" ... you may wish to remove the default UK keyboard to avoid confusion.

This works well for me in VirtualBox, I would expect it to work in VMWARE / Parallels but I've not tested it, as with everything I do YMMV :)