topic Re: Upgrading to 2.4 in Network Access Control

Upgrading to 2.4

Ping Zhou — Mon, 16 Apr 2018 18:21:04 GMT

Can SNS-3495-K9 or its VM equivalent support version 2.4? I can't find it in the release notes.

The release note for 2.4 is attached for quick ref. Thanks.

Re: Upgrading to 2.4

Craig Hyps — Tue, 17 Apr 2018 00:52:43 GMT

No. The 34x5 series hardware appliances are no longer supported in ISE 2.4. However...

The VM equivalent of the 3495 does exceed the specs of a 3515 when hyper-threading is enabled, so a previous 3495 VM would be detected as a 3515. If increase memory to 64GB, then it should meet 3595 specs. The 3415 VM would need two extra physical cores, for a total of 12 hyper-threaded cores to be detected as a 3515.

Since based on a UCS series server, the 3495 Hardware appliance could have ESXi installed and then used as a 3515 Virtual appliance. The 3415 would fall below required specs even with HT enabled and would be detected as EVAL with ESXi loaded. It could still serve as a lab/test system.

I would defer to ISE product management team as to whether a new VM license would be required, or if any allowance granted on a migration of appliance to different platform.

Re: Upgrading to 2.4

hslai — Tue, 17 Apr 2018 02:34:00 GMT

Adding to Craig's...

The release notes have the info under Licensing Changes

...

If you are planning to upgrade to Release 2.4, contact ise-vm-license@cisco.com for sales orders that include VM purchase to procure one medium VM license for each VM previously purchased.

The following table shows how the VM resources are categorized:

VM Category

RAM Range

Number of CPU Cores

Small

0 to 16 GB

up to 6 cores

Medium

greater than 16 GB to 64GB

7 or 8 cores

Large

greater than 64GB

greater than 8 cores

Re: Upgrading to 2.4

Ping Zhou — Tue, 17 Apr 2018 14:52:23 GMT

Thanks, if I have to stay with my 10x SNS-3495 nodes without going with VM.. I'm currently running Sponsored Guest, Wired+Wireless Dot1x (EAP-TLS), Profiling and Posture Assessment with "AnyConnect + Compliance Modules". Between 2.2p7 and 2.3p3, which one is better? I went through the "ISE upgrade - Best Practice" by Mr Thiruvengadam, I still have this question. Thanks for any input,

Re: Upgrading to 2.4

Jason Kunst — Tue, 17 Apr 2018 15:22:57 GMT

Right now recommendation is 2.2 with latest patch unless you need something in 2.3

Re: Upgrading to 2.4

tolarosa@cisco.com — Tue, 24 Apr 2018 12:02:11 GMT

So does every customer that purchased a standard VM-K9 prior to 2.4 need to contact the ise-vm-license email prior to upgrading to 2.4?

Re: Upgrading to 2.4

Jason Kunst — Tue, 24 Apr 2018 12:04:11 GMT

No they can upgrade but will be annoyed by a vm license alarm

Re: Upgrading to 2.4

Craig Hyps — Tue, 24 Apr 2018 12:21:34 GMT

Correct. Enforcement is planned, but for 2.4 you will receive warnings similar to what you may see today for exceeding session counts.