topic Re: Replacing ISE instance on DNAC in Network Access Control

Replacing ISE instance on DNAC

Gaurav Sharma — Fri, 29 Jun 2018 15:27:10 GMT

Hello Experts!

Is there a migration path for replacing an ISE instance from DNAC ?

We would like to replace our 2.3 instance with 2.4

The issue is you cannot just remove the ISE server.

DNA will not let you because it is used in the fabric

The only way I can see changing it at this point is to completely remove the fabric, the design, etc, and start over

If there is a migration path on steps that need to be taken in order to replace the ISE instance, Can you please share with me ?

-Gaurav Sharma

Re: Replacing ISE instance on DNAC

hslai — Fri, 29 Jun 2018 21:36:20 GMT

I believe you are correct about this current limitation. I would suggest you to discuss it with DNA-C PM teams for roadmaps.

Re: Replacing ISE instance on DNAC

Matthias — Wed, 20 Nov 2019 16:54:05 GMT

What is with the approache of the backup and restore scenario which is anyway the recommended way to upgrade a ISE deployment?

I mean it shout be possible to replace the ISE in a Fabric because of a hardware vm failture or whatever.

Thanks

Matthias

Re: Replacing ISE instance on DNAC

Mike.Cifelli — Wed, 20 Nov 2019 17:27:09 GMT

Why is the desire to "replace" the ISE instance? Why not perform an upgrade bundle to get from 2.3->2.4. I have been running an SDA fabric in production for about 14 months and have performed several DNAC & ISE upgrades. Our DNAC cluster has gone from 1.1.x->1.2.x->1.3.1.3. The ISE cluster has moved from 2.3.x->2.4p9 without rebuild issues, etc. Note to pay attention to the compatibility matrix for the two components when performing upgrades.

Re: Replacing ISE instance on DNAC

Arne Bier — Thu, 26 Mar 2020 06:03:02 GMT

Hi @Matthias

It's been a while since you asked this question - did you receive any answers?

I am in the situation now where I have an ISE 2.4 integrated with DNAC 1.3 and I need to switch over to another ISE server (ISE 2.7).

It was a painful exercise to get these two things talking to each other. How did you proceed in the end?

regards

Arne

Re: Replacing ISE instance on DNAC

Matthias — Thu, 02 Apr 2020 12:48:23 GMT

Hi Arne,

Im still in contact with Tac/BU about that.

I tested a backup/restore upgrade in my DNA Lab. So, taking a backup of e.g. ISE 2.3 and restore it to a 2.4 is working well as long as the fqdn and ip are the same.

regards
Matthias

Re: Replacing ISE instance on DNAC

Arne Bier — Thu, 02 Apr 2020 23:27:36 GMT

Hi @Matthias

I had some success last night.

I created a place-holder AAA server in DNAC and assigned all existing config to point to that. That allowed me to delete the existing ISE entry in DNAC.

After some faffing around in my ISE 2.7 server which was a clean ISE 2.7 install, and then I restored my ISE 2.4 backup onto it, to simulate the scenario where I had to migrate/rebuild my ISE node. Because my config restore dumped a bunch of legacy config and certs, I had to do some work (enabling ERS, rebuilding the internal CA, issuing myself a pxGrid cert signed by the ISE CA) I was able to get pxGrid working. I then integrated DNAC with ISE - that was relatively smooth.

I did notice that many of my devices are shown as "not provisioned" in DNAC, or Credentials are not ok. But that is my next mission - to figure out how to re-provision all my existing Cat9K, 9800 controllers etc now that new ISE is integrated.

Re: Replacing ISE instance on DNAC

Matthias — Fri, 03 Apr 2020 09:20:34 GMT

Hi Arne,

that sounds like you may figure out a good way to migrate the ISE in a DNAC.

Espacially the you first point (place-holder AAA) is very interessting. I tried this as well and it didnt work, I may have to try it again in my lab.

Which DNAC version do you running?

Can you check the db on maglev, because it would be interessting what settings are stored there?

Regards

Matthias

Re: Replacing ISE instance on DNAC

Matthias — Sat, 08 Aug 2020 14:31:46 GMT

Just a quick response on that topic.

In the meentime I replaces a ISE 2.3 in a productive SD-Access Network by installing a new ISE 2.4 and restore the backup from 2.3.

Switching to new ISE was no problem at all. Just disabled the old ISE VM Network and enabled the new one. No issues with DNAC intigration.

Re: Replacing ISE instance on DNAC

Ping Zhou — Sun, 09 Aug 2020 18:29:35 GMT

How did you switch to the new ISE exactly? When you restores to the new ISE, did you do it with ADE-OS configuration? Thanks in advance.

Re: Replacing ISE instance on DNAC

Matthias — Fri, 04 Sep 2020 13:59:54 GMT

Th short version is:

1. Backup current ISE

2. Install a new VM in Version 2.4 / .6 + patch

3. Restore Backup with ADE-OS

4. Change IP or setup a second interface to check config

5. Shut old ISE VM network interface

6. Enable new ISE VM network interface with the same IP like the old one.

7. Check all your services

8. Join a clean secondary node and sync it

Re: Replacing ISE instance on DNAC

Ping Zhou — Fri, 04 Sep 2020 14:37:31 GMT

Thank you! This is very helpful.

Re: Replacing ISE instance on DNAC

Cyptic man — Fri, 21 Oct 2022 07:44:29 GMT

Hi!

Interesting. Are you saying that if you changed the network settings (endpoints) from ISE to AAA, saved the config you where able to remove the whole ISE integration in the DNA settings / Authentication servers section?