Cisco ISE 3.5 (build 3.5.0.527) is out, and I wanted a clean standalone node to build future labs on. This post walks through that first boot. It covers the setup prompts, how to confirm the application is really up from the CLI, the forced password reset on the first GUI login, and the Administration pages worth checking before you add a single network device.
If you're new to the product, start with Introduction to Cisco ISE for what ISE does and where it sits in an 802.1X design.
Everything here was built in my home lab. All IP addresses are RFC 5737 documentation addresses, and serials, MACs and passwords are redacted.
What I used
- Cisco ISE 3.5.0.527, standalone (all personas on one node)
- 16 cores, 24 GB RAM, 300 GB disk
- One interface (GigabitEthernet 0)
- 90-day evaluation license
| Setting | Value used in this post |
|---|---|
| Hostname | ise35 |
| IP / mask | 192.0.2.10 / 255.255.255.0 |
| Default gateway | 192.0.2.1 |
| DNS domain | example.com |
| Name server | 192.0.2.1 |
| NTP | time.google.com, time.cloudflare.com |
| Time zone | America/Los_Angeles |
| SSH | enabled |
Step 1: Answer the setup prompts
On first boot ISE stops at the localhost login: prompt. Type setup and the wizard asks for the hostname, DNS domain, IPv4 address, netmask and default gateway, an optional IPv6 address, the name servers, the NTP servers, the time zone, whether to enable SSH, and finally the CLI admin username and password. The values I used are in the table above.
ISE then checks that it can reach the gateway, resolve DNS and sync to NTP, and runs a short disk I/O test. On my node that came back at about 189 MB/s write and 555 MB/s read. Next it installs the ISE application and runs the database initial setup, which is the longest stage. When that finishes, the node reboots and comes back at an ise35 login: prompt. From accepting the setup answers to a working GUI login page took about 75 minutes on my node.
Be patient. The CLI is ready long before the web UI. On my node HTTPS returned 502 for a good while after the reboot, then started serving the login page. Wait for every service to show running (Step 2) before you worry.
Step 2: Verify from the ISE CLI
SSH to the node as admin with the CLI password you set during setup.
show version
ise35/admin#show version
Cisco Application Deployment Engine OS Release: 3.5
ADE-OS Build Version: 3.5.0.331
ADE-OS System Architecture: x86_64
Copyright (c) 2005-2025 by Cisco Systems, Inc.
All rights reserved.
Hostname: ise35
Version information of installed applications
---------------------------------------------
Cisco Identity Services Engine
---------------------------------------------
Version : 3.5.0.527
Build Date : Thu Sep 18 14:35:46 2025
Install Date : Thu Oct 29 09:19:50 2026
show application status ise
This is the check that matters. The GUI is not ready until the core services show running. Services you haven't enabled, such as PassiveID, SXP, TC-NAC and the DHCP and DNS servers, show disabled, which is expected.
ise35/admin#show application status ise
ISE PROCESS NAME STATE PROCESS ID
--------------------------------------------------------------------
Database Listener running 16512
Database Server running 128 PROCESSES
ISE Data Grid Service running 70931
Application Server running 23723
Profiler Database running 24388
ISE Elasticsearch running 63088
AD Connector running 76047
M&T Session Database running 19144
M&T Log Processor running 79547
Certificate Authority Service running 64329
EST Service running 96270
SXP Engine Service disabled
TC-NAC Service disabled
PassiveID WMI Service disabled
PassiveID Syslog Service disabled
PassiveID API Service disabled
PassiveID Agent Service disabled
PassiveID Endpoint Service disabled
PassiveID SPAN Service disabled
DHCP Server (dhcpd) disabled
DNS Server (named) disabled
ISE Messaging Service running 28380
ISE API Gateway Database Service running 25484
ISE API Gateway Service running 53524
ISE pxGrid Direct Service running 70284
ISE pxGrid Direct Pusher running 75610
Segmentation Policy Service disabled
REST Auth Service running 69011
SSE Connector disabled
Hermes (pxGrid Cloud Agent) disabled
MFA (Duo Sync Service) disabled
McTrust (Meraki Sync Service) disabled
aciconn (ACI Connection Service) disabled
Workload Connector Service disabled
ISE Prometheus Service disabled
ISE Prometheus Exporter disabled
ISE Grafana Service disabled
ISE MNT LogAnalytics Elasticsearch running 98765
ISE Kibana Service disabled
ISE Native IPSec Service running 27700
Remote Support Authorization Service disabled
MFC Profiler running 88760
ISE Prometheus Alertmanager Service disabled
Protocols Engine running 99044
show inventory (excerpt)
The PID is ISE-VM-K9. You'll need the serial number for Smart Licensing later, and you can also read it with show udi.
ise35/admin#show inventory
NAME: "ISE-VM-K9 chassis", DESCR: "ISE-VM-K9 chassis"
PID: ISE-VM-K9, VID: V01, SN: XXXXXXXXXXX
Total RAM Memory: 24393848 kB
CPU Core Count: 16
Hard Disk Count(*): 1
Disk 0: Capacity: 300GiB
NIC Count: 1
NIC 0: Device Name: eth0:
show ntp, show clock, show timezone
Time matters more on ISE than almost anywhere else, because certificates, AD joins and log correlation all depend on it. Check that NTP is actually synchronised (^*) and not just configured.
ise35/admin#show ntp
Configured NTP Servers:
time.google.com
time.cloudflare.com
Reference ID : D8EF2304 (time2.google.com)
Stratum : 2
System time : 0.000000243 seconds slow of NTP time
Leap status : Normal
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* time2.google.com 1 9 377 461 -200us[ +464us] +/- 10ms
^+ time.cloudflare.com 3 9 377 207 -183us[ -183us] +/- 24ms
ise35/admin#show clock
Thu Oct 29 10:58:09 PDT 2026
ise35/admin#show timezone
America/Los_Angeles
show running-config (excerpt)
ise35/admin#show running-config
interface GigabitEthernet 0
ip address 192.0.2.10 255.255.255.0
ipv6 enable
ipv6 address autoconfig
!
ntp server time.google.com
ntp server time.cloudflare.com
hostname ise35
icmp echo on
ip domain-name example.com
ip default-gateway 192.0.2.1
ip name-server 192.0.2.1
logging loglevel 6
password-policy
digit-required
lower-case-required
min-password-length 8
no-previous-password
password-expiration-days 45
password-expiration-enabled
password-lock-enabled
password-lock-retry-count 3
password-lock-timeout 15
upper-case-required
!
service sshd enable
clock timezone America/Los_Angeles
conn-limit cl 5 port 9061
conn-limit cl1 30 port 9060
username admin password hash <redacted>
Note the default CLI password policy: passwords expire after 45 days and the account locks after three failed attempts. Put a reminder in your calendar, or plan to change the policy deliberately. I left it at the defaults.
show ip route
ise35/admin#show ip route
Destination Gateway Iface
----------- ------- -----
default 192.0.2.1 eth0
192.0.2.0/24 0.0.0.0 eth0
ISE 3.5 also adds several internal 169.254.x.0/24 routes on podman interfaces for its containerised services. Those are internal to ISE and normal.
Step 3: First GUI login and the forced password reset
Browse to https://192.0.2.10/admin/ and accept the self-signed certificate warning.
Log in as admin with the password from setup. ISE immediately asks you to reset the GUI password. The rules are shown on the page: more than 8 characters, upper and lower case, a digit, and not the admin name or its characters in reverse order.
Two things that caught me out:
- The Reset Password button stays greyed out until both fields pass the policy.
- The GUI password and the CLI password are separate after the reset. Changing the GUI password doesn't change the SSH password, so store both.
After the reset you land on the Dashboard with a short welcome carousel. The first card warns that changing the password can break existing API scripts. The last card is a deprecation notice that ERS on port 9060 and SMBv1 are going away, so plan to use ERS on 443 and SMBv2 or v3. Tick Don't show me this message again and click through to Accept and close.
The banner shows Evaluation Mode 89 Days. The evaluation license unlocks every feature for 90 days.
Step 4: Check the Administration pages
Deployment: confirm the standalone node
Administration > System > Deployment. There should be one node with every persona (Administration, Monitoring and Policy Service), with role STANDALONE and a green status.
Licensing: evaluation and UDI
Administration > System > Licensing. This page shows the UDI (PID ISE-VM-K9, VID V01, serial number) and the Smart Licensing, PLR and SLR registration options. Leave it unregistered for now if you're happy with the evaluation license.
Certificates: the defaults
Administration > System > Certificates > System Certificates. A fresh node has self-signed and internal-CA certificates for the Admin, EAP, Portal, pxGrid, ISE Messaging, Data Grid and SAML roles. Replace the Admin and EAP certificates with ones from your own CA before you onboard real clients.
Admin Access: password policy
Administration > System > Admin Access > Authentication > Password Policy. This is the GUI and CLI password policy shown above. I only looked at it and left it unchanged.
System Time
Administration > System > Settings > System Time. Confirm the time zone and the NTP servers you set during setup.
API Settings: ERS and OpenAPI
Administration > System > Settings > API Settings. OpenAPI is always on. ERS is off by default unless you enable it. On this node ERS is enabled, so the toggle shows ERS (Read/Write) on. Use port 443 for new scripts, because the overview page warns that port 9060 won't be supported for ERS in later releases.
Network Devices: empty and ready
Administration > Network Resources > Network Devices. The list is empty. This is where your switches, WLCs and firewalls go as RADIUS or TACACS+ clients in the next lab.
First-boot checklist
Done on this node:
- Setup completed, with hostname, IP, DNS, NTP, timezone and SSH set
show application status iseshows the core servicesrunning- NTP synchronised (
^*inshow ntp) - GUI password reset, with the GUI and CLI passwords stored separately
- Welcome and deprecation notices acknowledged
- Standalone node with all personas
- Evaluation license active (90 days)
- ERS and OpenAPI enabled
Still to do:
- Replace the Admin and EAP certificates
- Schedule a configuration backup. The dashboard alarm "No Configuration Backup Scheduled" is a fair reminder.
- Add the first network device
What's next
With a clean, time-synced standalone node, the next step is adding a switch as a network device and getting a first RADIUS authentication into the live logs. For the policy side of that, see Configuring Cisco ISE as a RADIUS Server for 802.1X and the Cisco ISE 802.1X wired configuration guide.