topic Upgrade ISE 2.3 to 2.4, new HW in Network Access Control

Upgrade ISE 2.3 to 2.4, new HW

Servicio Tac — Mon, 11 Nov 2019 22:12:57 GMT

Hi team

I planning the upgrade from ise 2.3 to ise 2.4 in a two nodes deployment to a new HW. Already read the upgrade document and I think this is the procedure.

ise01a = ise 2.3 primary node (3415)

ise02a = ise 2.3 secondary node (3415)

ise01b = ise 2.4 (3655)

ise02b = ise 2.4 (3655)

1.- Take a configuration and operation backup from ise01a, also the show run from ise01a and ise02a

2.- Export the certificate from ise01a

3.- Deregister ise02a from 2.3 deployment.

4.- Shutdown ise02a

5.- Power on ise02b (the appliance already have the version 2.4 patch 10 loaded)

6.- Load the show run from ise02a to ise02b

7.- Restore the ise02b from configuration/operational backup from ise01a

8.- Importe the certificate from ise01a

9.- Assign at ise02b as primary node.

10.- Shutdown ise01a

11.- Power on ise01b (the appliance already have the version 2.4 patch 10 loaded)

10.- Load the show run from ise01a to ise01b

11.- Restore the ise01b from configuration/operational backup from ise01a

12 .- Assign at ise02b as secondary node.

13.- change the ise01b as primary and ise02b as secondary

I'm ok with the procedure?

Regards.

Re: Upgrade ISE 2.3 to 2.4, new HW

Arne Bier — Tue, 12 Nov 2019 00:32:01 GMT

I think you may face an issue with

7.- Restore the ise02b from configuration/operational backup from ise01a

8.- Importe the certificate from ise01a

When you restore the config backup onto ise02b, then the node should also get the certificate that you had on ise02a, and not ise01a - the FQDN on ise02b must match the Subject Common name of the Admin cert (or ... unless you have a wildcard cert or Multi-Domain Cert, then ignore what I have said - but check you Admin cert to ensure it will match the node's FQDN)

Step 11 is not correct

11.- Restore the ise01b from configuration/operational backup from ise01a

You don't restore the config - you need to register the secondary node to the primary. Once done, the Secondary sync's up with the Primary.

This step happens during the registration phase.

12 .- Assign at ise02b as secondary node.

So I would say steps 11 and 12 would look like this

11. Install Cert Chain (Trusted Certs) for the Admin cert you're going to use. Then import the Admin cert from ise01a

12. From ise02b Register the new node ise02a and assign it the Secondary roles (Admin/MnT) and all the other stuff like Policy etc.

This is a very condensed version. There are many moving parts but you're on the right track.

I normally don't migrate certs from old system to new system. I would create a CSR on each node and have new certs created.

Re: Upgrade ISE 2.3 to 2.4, new HW

Servicio Tac — Tue, 12 Nov 2019 14:23:43 GMT

Thanks for your anwser

The idea it's have the lowest impact to the end user, that why we want export the certificates to the 2.3 to 2.4

Your are right with the Certificate and FQDN... May be an option start with the procedure with the node ise01a to ise01b

Regards.