topic Re: About upgrading a distributed ISE deployment through CLI in Network Access Control

About upgrading a distributed ISE deployment through CLI

Cheng — Fri, 02 Nov 2018 12:29:47 GMT

Hi Experts,

We need to upgrade a distributed ISE deployment from 2.3 to 2.4 from the CLI, to remain AAA service online consistently. There is a question confusing me. As per the upgrade guide as below, after upgrading, the Secondary Administration Node (node B) becomes the primary node of the new deployment when it restarts. Then MNT and PSN nodes will be upgraded in sequence.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/upgrade_guide/b_ise_upgrade_guide_24/b_ise_upgrade_guide_24_chapter_011.html#ID20

My question is how the MNT and PSN nodes join the new primary PAN node? Do they join it automatically? Or we have to add them to the new PAN manually?

Could anyone give me some guidance on this? Thanks in advance.

Re: About upgrading a distributed ISE deployment through CLI

hslai — Fri, 02 Nov 2018 14:28:20 GMT

Manually. When we upgrade an ISE deployment from CLI, we need to take care of de-registering and re-registering ourselves manually. The automated actions are part of the upgrade via ISE admin web UI.

If not already done, please review ISE Upgrades - Best Practices.

Re: About upgrading a distributed ISE deployment through CLI

Cheng — Fri, 02 Nov 2018 14:37:20 GMT

Many thanks hslai!