topic Re: How do I change the IP of ISE if it's the secondary in a group? in Network Access Control

How do I change the IP of ISE if it's the secondary in a group?

Andrew White — Wed, 02 Oct 2019 15:47:26 GMT

Hello,

We have 2 x Cisco ISE virtual appliances, 1 is in our local VMware hypervisor and the other in our remote datacenter which acts as the standby.

We have a new datacenter and I need to move the secondary ISE appliance there so it will have a new IP. I just don't know the steps involved once's I've moved it over.

On ISE I can see in Admin > Deployment there 2 are there in a group but you can't edit it etc.

Any steps would be great, thanks.

Re: How do I change the IP of ISE if it's the secondary in a group?

Mike.Cifelli — Wed, 02 Oct 2019 16:40:45 GMT

You will need to change the IP via CLI access. Very similar as to how you would configure an SVI on a L3 switch. Good luck & HTH!

Re: How do I change the IP of ISE if it's the secondary in a group?

Andrew White — Wed, 02 Oct 2019 20:28:54 GMT

Thanks that’s sounds simple, so I just shut down the ISE VM and vMotion to the new site, turn on and change the IP, mask and GW and job done? Then both will sync with each other?

Re: How do I change the IP of ISE if it's the secondary in a group?

Mike.Cifelli — Thu, 03 Oct 2019 00:44:55 GMT

Yes. You can always re-sync the nodes via your PAN admin GUI after performing the changes. Note that when the ISE nodes are running it is in your best interest to not use vMotion and/or snapshots. Good luck & HTH!

Re: How do I change the IP of ISE if it's the secondary in a group?

Andrew White — Thu, 03 Oct 2019 08:23:24 GMT

So it's best to shutdown the secondary and then move and turn on and change the IP info via CLI?

Exactly where is the re-sync location in the GUI I'm struggling to locate this?

Thanks

Re: How do I change the IP of ISE if it's the secondary in a group?

networke networke — Thu, 03 Oct 2019 15:45:31 GMT

Do not do what you've been told so far. There is a right way to do this: step #1: De-register the Secondary node from the cluster in the UI, step #2: change the IP address of the node, this will force ISE application service to restart, step #3: perform "application reset-config ise" step #4: join the ISE back into the cluster. This method works 100% of the time and SUPPORT by Cisco TAC.

Re: How do I change the IP of ISE if it's the secondary in a group?

Mike.Cifelli — Thu, 03 Oct 2019 16:29:32 GMT

To re-sync: Administration->System->Deployment->Deployment Nodes->Syncup

Re: How do I change the IP of ISE if it's the secondary in a group?

Jason Kunst — Thu, 03 Oct 2019 17:00:41 GMT

@networke networke wrote:
Do not do what you've been told so far. There is a right way to do this: step #1: De-register the Secondary node from the cluster in the UI, step #2: change the IP address of the node, this will force ISE application service to restart, step #3: perform "application reset-config ise" step #4: join the ISE back into the cluster. This method works 100% of the time and SUPPORT by Cisco TAC.

Doesn't this depend on the type of setup? if this is a standalone HA setup (PAN/PSN/MNT) on same box then wouldn't you recommend just building a new box from scratch and adding it to the primary? Or even if its PAN or MNT?

What you're saying is fine for a PSN only.

Re: How do I change the IP of ISE if it's the secondary in a group?

Damien Miller — Thu, 03 Oct 2019 21:41:26 GMT

Yeah, it's a little overkill but would of course still work.

Eddie wrote a great guide on how to handle this though the ADE-OS command "reset-config", not to be confused with the "application reset-config ise" command which wipes the node config.
https://community.cisco.com/t5/security-blogs/reset-ise-host-os-config-with-a-single-cli/ba-p/3660180