> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # Cisco ISE 3.5 Initial Setup: First Boot, CLI Checks and GUI Login - URL: https://www.pinglabz.com/cisco-ise-3-5-initial-setup/ - Published: 2026-10-29T18:16:58.000Z - Updated: 2026-10-30T00:23:39.000Z - Description: Cisco ISE 3.5.0.527 first boot, built in my home lab: setup values, CLI checks that prove the services are up, the forced GUI password reset and the Administration pages to review first. - Author: Jaime - Tags: 802.1X, Security, Cisco Cisco ISE 3.5 (build 3.5.0.527) is out, and I wanted a clean standalone node to build future labs on. This post walks through that first boot. It covers the setup prompts, how to confirm the application is really up from the CLI, the forced password reset on the first GUI login, and the Administration pages worth checking before you add a single network device. If you're new to the product, start with [Introduction to Cisco ISE](https://www.pinglabz.com/cisco-ise-intro/) for what ISE does and where it sits in an 802.1X design. Everything here was built in my home lab. All IP addresses are RFC 5737 documentation addresses, and serials, MACs and passwords are redacted. ## What I used - Cisco ISE 3.5.0.527, standalone (all personas on one node) - 16 cores, 24 GB RAM, 300 GB disk - One interface (GigabitEthernet 0) - 90-day evaluation license | Setting | Value used in this post | | --------------- | ------------------------------------ | | Hostname | ise35 | | IP / mask | 192.0.2.10 / 255.255.255.0 | | Default gateway | 192.0.2.1 | | DNS domain | example.com | | Name server | 192.0.2.1 | | NTP | time.google.com, time.cloudflare.com | | Time zone | America/Los\_Angeles | | SSH | enabled | ## Step 1: Answer the setup prompts On first boot ISE stops at the `localhost login:` prompt. Type `setup` and the wizard asks for the hostname, DNS domain, IPv4 address, netmask and default gateway, an optional IPv6 address, the name servers, the NTP servers, the time zone, whether to enable SSH, and finally the CLI admin username and password. The values I used are in the table above. ISE then checks that it can reach the gateway, resolve DNS and sync to NTP, and runs a short disk I/O test. On my node that came back at about 189 MB/s write and 555 MB/s read. Next it installs the ISE application and runs the database initial setup, which is the longest stage. When that finishes, the node reboots and comes back at an `ise35 login:` prompt. From accepting the setup answers to a working GUI login page took about 75 minutes on my node. **Be patient.** The CLI is ready long before the web UI. On my node HTTPS returned `502` for a good while after the reboot, then started serving the login page. Wait for every service to show `running` (Step 2) before you worry. ## Step 2: Verify from the ISE CLI SSH to the node as `admin` with the CLI password you set during setup. ### show version ```text ise35/admin#show version Cisco Application Deployment Engine OS Release: 3.5 ADE-OS Build Version: 3.5.0.331 ADE-OS System Architecture: x86_64 Copyright (c) 2005-2025 by Cisco Systems, Inc. All rights reserved. Hostname: ise35 Version information of installed applications --------------------------------------------- Cisco Identity Services Engine --------------------------------------------- Version : 3.5.0.527 Build Date : Thu Sep 18 14:35:46 2025 Install Date : Thu Oct 29 09:19:50 2026 ``` ### show application status ise This is the check that matters. The GUI is not ready until the core services show `running`. Services you haven't enabled, such as PassiveID, SXP, TC-NAC and the DHCP and DNS servers, show `disabled`, which is expected. ```text ise35/admin#show application status ise ISE PROCESS NAME STATE PROCESS ID -------------------------------------------------------------------- Database Listener running 16512 Database Server running 128 PROCESSES ISE Data Grid Service running 70931 Application Server running 23723 Profiler Database running 24388 ISE Elasticsearch running 63088 AD Connector running 76047 M&T Session Database running 19144 M&T Log Processor running 79547 Certificate Authority Service running 64329 EST Service running 96270 SXP Engine Service disabled TC-NAC Service disabled PassiveID WMI Service disabled PassiveID Syslog Service disabled PassiveID API Service disabled PassiveID Agent Service disabled PassiveID Endpoint Service disabled PassiveID SPAN Service disabled DHCP Server (dhcpd) disabled DNS Server (named) disabled ISE Messaging Service running 28380 ISE API Gateway Database Service running 25484 ISE API Gateway Service running 53524 ISE pxGrid Direct Service running 70284 ISE pxGrid Direct Pusher running 75610 Segmentation Policy Service disabled REST Auth Service running 69011 SSE Connector disabled Hermes (pxGrid Cloud Agent) disabled MFA (Duo Sync Service) disabled McTrust (Meraki Sync Service) disabled aciconn (ACI Connection Service) disabled Workload Connector Service disabled ISE Prometheus Service disabled ISE Prometheus Exporter disabled ISE Grafana Service disabled ISE MNT LogAnalytics Elasticsearch running 98765 ISE Kibana Service disabled ISE Native IPSec Service running 27700 Remote Support Authorization Service disabled MFC Profiler running 88760 ISE Prometheus Alertmanager Service disabled Protocols Engine running 99044 ``` ### show inventory (excerpt) The PID is `ISE-VM-K9`. You'll need the serial number for Smart Licensing later, and you can also read it with `show udi`. ```text ise35/admin#show inventory NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis" PID: ISE-VM-K9, VID: V01, SN: XXXXXXXXXXX Total RAM Memory: 24393848 kB CPU Core Count: 16 Hard Disk Count(*): 1 Disk 0: Capacity: 300GiB NIC Count: 1 NIC 0: Device Name: eth0: ``` ### show ntp, show clock, show timezone Time matters more on ISE than almost anywhere else, because certificates, AD joins and log correlation all depend on it. Check that NTP is actually synchronised (`^*`) and not just configured. ```text ise35/admin#show ntp Configured NTP Servers: time.google.com time.cloudflare.com Reference ID : D8EF2304 (time2.google.com) Stratum : 2 System time : 0.000000243 seconds slow of NTP time Leap status : Normal MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* time2.google.com 1 9 377 461 -200us[ +464us] +/- 10ms ^+ time.cloudflare.com 3 9 377 207 -183us[ -183us] +/- 24ms ise35/admin#show clock Thu Oct 29 10:58:09 PDT 2026 ise35/admin#show timezone America/Los_Angeles ``` ### show running-config (excerpt) ```text ise35/admin#show running-config interface GigabitEthernet 0 ip address 192.0.2.10 255.255.255.0 ipv6 enable ipv6 address autoconfig ! ntp server time.google.com ntp server time.cloudflare.com hostname ise35 icmp echo on ip domain-name example.com ip default-gateway 192.0.2.1 ip name-server 192.0.2.1 logging loglevel 6 password-policy digit-required lower-case-required min-password-length 8 no-previous-password password-expiration-days 45 password-expiration-enabled password-lock-enabled password-lock-retry-count 3 password-lock-timeout 15 upper-case-required ! service sshd enable clock timezone America/Los_Angeles conn-limit cl 5 port 9061 conn-limit cl1 30 port 9060 username admin password hash ``` Note the default CLI password policy: passwords expire after 45 days and the account locks after three failed attempts. Put a reminder in your calendar, or plan to change the policy deliberately. I left it at the defaults. ### show ip route ```text ise35/admin#show ip route Destination Gateway Iface ----------- ------- ----- default 192.0.2.1 eth0 192.0.2.0/24 0.0.0.0 eth0 ``` ISE 3.5 also adds several internal `169.254.x.0/24` routes on `podman` interfaces for its containerised services. Those are internal to ISE and normal. ## Step 3: First GUI login and the forced password reset Browse to `https://192.0.2.10/admin/` and accept the self-signed certificate warning. [![Cisco ISE 3.5 admin login page with username and password fields](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-login.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-login.png?ref=pinglabz.com) Log in as `admin` with the password from setup. ISE immediately asks you to reset the GUI password. The rules are shown on the page: more than 8 characters, upper and lower case, a digit, and not the admin name or its characters in reverse order. [![Cisco ISE 3.5 forced password reset on first admin GUI login](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-reset.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-reset.png?ref=pinglabz.com) Two things that caught me out: - The **Reset Password** button stays greyed out until both fields pass the policy. - The GUI password and the CLI password are **separate** after the reset. Changing the GUI password doesn't change the SSH password, so store both. After the reset you land on the Dashboard with a short welcome carousel. The first card warns that changing the password can break existing API scripts. The last card is a deprecation notice that ERS on port 9060 and SMBv1 are going away, so plan to use ERS on 443 and SMBv2 or v3\. Tick **Don't show me this message again** and click through to **Accept and close**. [![Cisco ISE 3.5 Updates Required welcome carousel after the password reset](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-first.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-first.png?ref=pinglabz.com) [![Cisco ISE 3.5 dashboard in Evaluation Mode with 89 days left and no endpoints](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-dashboard.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-dashboard.png?ref=pinglabz.com) The banner shows **Evaluation Mode 89 Days**. The evaluation license unlocks every feature for 90 days. ## Step 4: Check the Administration pages ### Deployment: confirm the standalone node **Administration > System > Deployment.** There should be one node with every persona (Administration, Monitoring and Policy Service), with role **STANDALONE** and a green status. [![Cisco ISE 3.5 Deployment page showing one standalone node ise35 with all personas](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-deployment.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-deployment.png?ref=pinglabz.com) ### Licensing: evaluation and UDI **Administration > System > Licensing.** This page shows the UDI (PID `ISE-VM-K9`, VID `V01`, serial number) and the Smart Licensing, PLR and SLR registration options. Leave it unregistered for now if you're happy with the evaluation license. [![Cisco ISE 3.5 Licensing page with UDI ISE-VM-K9 V01, serial redacted, and Smart Licensing options](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-licensing.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-licensing.png?ref=pinglabz.com) ### Certificates: the defaults **Administration > System > Certificates > System Certificates.** A fresh node has self-signed and internal-CA certificates for the Admin, EAP, Portal, pxGrid, ISE Messaging, Data Grid and SAML roles. Replace the Admin and EAP certificates with ones from your own CA before you onboard real clients. [![Cisco ISE 3.5 System Certificates list on a new node](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-certificates.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-certificates.png?ref=pinglabz.com) ### Admin Access: password policy **Administration > System > Admin Access > Authentication > Password Policy.** This is the GUI and CLI password policy shown above. I only looked at it and left it unchanged. [![Cisco ISE 3.5 GUI and CLI password policy under Admin Access](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-admin-password-policy.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-admin-password-policy.png?ref=pinglabz.com) ### System Time **Administration > System > Settings > System Time.** Confirm the time zone and the NTP servers you set during setup. [![Cisco ISE 3.5 System Time page with America/Los_Angeles and two NTP servers](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-system-time.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-system-time.png?ref=pinglabz.com) ### API Settings: ERS and OpenAPI **Administration > System > Settings > API Settings.** OpenAPI is always on. ERS is off by default unless you enable it. On this node ERS is enabled, so the toggle shows **ERS (Read/Write)** on. Use port 443 for new scripts, because the overview page warns that port 9060 won't be supported for ERS in later releases. [![Cisco ISE 3.5 API Settings overview for ERS and OpenAPI](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-api-settings.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-api-settings.png?ref=pinglabz.com) [![Cisco ISE 3.5 API Service Settings with ERS Read/Write enabled](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-api-service-settings.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-api-service-settings.png?ref=pinglabz.com) ### Network Devices: empty and ready **Administration > Network Resources > Network Devices.** The list is empty. This is where your switches, WLCs and firewalls go as RADIUS or TACACS+ clients in the next lab. [![Cisco ISE 3.5 empty Network Devices list](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-network-devices.png)](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/10/cisco-ise-3-5-setup-network-devices.png?ref=pinglabz.com) ## First-boot checklist Done on this node: - Setup completed, with hostname, IP, DNS, NTP, timezone and SSH set - `show application status ise` shows the core services `running` - NTP synchronised (`^*` in `show ntp`) - GUI password reset, with the GUI and CLI passwords stored separately - Welcome and deprecation notices acknowledged - Standalone node with all personas - Evaluation license active (90 days) - ERS and OpenAPI enabled Still to do: - Replace the Admin and EAP certificates - Schedule a configuration backup. The dashboard alarm "No Configuration Backup Scheduled" is a fair reminder. - Add the first network device ## What's next With a clean, time-synced standalone node, the next step is adding a switch as a network device and getting a first RADIUS authentication into the live logs. For the policy side of that, see [Configuring Cisco ISE as a RADIUS Server for 802.1X](https://www.pinglabz.com/configuring-cisco-ise-radius-server-802-1x/) and the [Cisco ISE 802.1X wired configuration guide](https://www.pinglabz.com/cisco-ise-802-1x-wired-configuration-guide/).