topic Re: Cisco ISE 2.1 Patch Update in Network Access Control

Cisco ISE 2.1 Patch Update

dot1x — Mon, 22 Oct 2018 02:11:15 GMT

Hi All,

Could someone please assist how long does it take to apply patch on Cisco ISE (distributed environment).

We have 1 PAN, 1 SAN, 3 PSNs running 2.1

Thanks.

Re: Cisco ISE 2.1 Patch Update

Damien Miller — Mon, 22 Oct 2018 03:04:04 GMT

I would plan for about 45 minutes a node. Each node will reload after patch instalation.

Re: Cisco ISE 2.1 Patch Update

hslai — Mon, 22 Oct 2018 22:32:01 GMT

For production, I would suggest to apply patches via CLI because this way gives us a better control when and which ISE nodes to start patching and possible to do a few ISE nodes at the same time. Please remember to take an ISE CFG backup beforehand.

Re: Cisco ISE 2.1 Patch Update

dot1x — Mon, 22 Oct 2018 22:39:30 GMT

Thanks for response.
If we go with CLI, is there any specific sequence we should follow?
Also, what would be the downtime for the users?
Thanks.

Re: Cisco ISE 2.1 Patch Update

hslai — Mon, 22 Oct 2018 22:44:19 GMT

First to the primary ISE node and the rest can be in any given order. Best to schedule a maintenance window and use a load balancer to take patching PSNs offline or online.

Re: Cisco ISE 2.1 Patch Update

dot1x — Mon, 22 Oct 2018 22:53:59 GMT

For 5 nodes deployment, a maintenance window of 5 hours would work?

Re: Cisco ISE 2.1 Patch Update

Damien Miller — Mon, 22 Oct 2018 22:58:13 GMT

Start with the primary admin node, then choose the node order you want after that. 5 hours should be enough for five nodes.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100.html#ID202
"If you are installing the patch from the CLI, you can control the order in which the nodes are updated. However, we recommend that you install the patch on the Primary PAN first."

You will use the command "patch install <patch name> <repo name that has patch file>"

The impact to users and services depends on which node is patching and your HA config. If you have redundant radius servers configured on your NAD's then user impact should be relatively minor.

Read this section of the admin guide to see what will be unavailable while the primary admin node is down/patching.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010.html#ID59

Re: Cisco ISE 2.1 Patch Update

dot1x — Mon, 22 Oct 2018 23:09:29 GMT

Thanks guys!