topic Re: ISE migration - Backup/Restore in Network Access Control

ISE migration - Backup/Restore

Josh Morris — Wed, 10 Jul 2019 20:15:40 GMT

I have a current 2.2 deployment in a mixed physical/virtual environment. I am migrating to an all physical 2.4 environment. The new 2.4 environment is currently greenfield. My current migration strategy is to take a backup of the 2.2 environment, and perform a restore in the 2.4 environment. And since my PSNs are behind an f5 load balancer, I will flip the pool when I'm ready for the 2.4 environment to handle production traffic.

My concern is that I named the 2.4 nodes differently. What will happen when I try to restore a backup from an environment with one naming convention into an environment with a different naming convention? Are there any other gotchas I should consider?

Re: ISE migration - Backup/Restore

Damien Miller — Wed, 10 Jul 2019 21:44:37 GMT

As long as you have A and PTR DNS records created for the new names, and don't restore the ADE OS, it will not be an issue. I restore ISE backups from production on to differently named lab VM's quite frequently. So the key here is not to leverage the "include-adeos" option.

Also keep in mind that if you have anything leveraging the names of old ISE nodes, those would have to change.

If the restore fails for any reason, running the URT on the existing 2.2 secondary PAN would be your next step, submitting any log package that it generates. When you restore 2.2 to 2.4, it will effectly upgrade the data during restore.

Re: ISE migration - Backup/Restore

Josh Morris — Thu, 11 Jul 2019 12:11:29 GMT

Thanks. I just thought of a follow-up question. Should I even configure anything on the new 2.4 deployment? Mainly something like Active Directory integration? Or will the backup/restore just wipe everything out and reconfigure it anyway?