topic Re: ISE distributed deployment upgrade - 1.3 to 2.1 in Network Access Control

ISE distributed deployment upgrade - 1.3 to 2.1

dot1x — Mon, 11 Dec 2017 03:00:49 GMT

My customer has an ISE deployment with 5 nodes: Admin/Monitor Primary and Secondary plus 3 Policy Server. The Admin Nodes and 2 Policty Nodes are VMs. The last Policy node is 3415 appliance.

I checked the release notes, it says that we can directly upgrade from 1.3 to 2.1.

Could someone share their experience or a step-by-step document to upgrade this distributed environment ISE deployment?

Thanks.

Re: ISE distributed deployment upgrade - 1.3 to 2.1

Nidhi — Mon, 11 Dec 2017 03:45:32 GMT

Hi Moin,

you can directly upgrade to 2.1 from 1.3

couple of guidelines and steps are mentioned in the links below -

Cisco Identity Services Engine Upgrade Guide, Release 2.1 - Cisco ISE Upgrade Overview [Cisco Identity Services Engine…

Cisco Identity Services Engine Upgrade Guide, Release 1.3 - Upgrade Methods for Different Types of Deployments [Cisco …

Re: ISE distributed deployment upgrade - 1.3 to 2.1

paul — Mon, 11 Dec 2017 20:42:50 GMT

As I have posted previously, I would recommend not using any of the Cisco documented GUI/CLI methods for upgrading. The method I have found to work the best over the years is:

Kick out secondary admin node from the old deployment.
Fresh build it to the desired version
Restore data from old version
Verify restored data. This node now becomes the anchor point of the new version deployment.
One at a time rebuild each PSN by installing a fresh build of the new version
Join the PSNs to the new deployment
Finally rebuild what was the primary admin node of the old deployment and join it to the new deployment
Move personas around as needed

Re: ISE distributed deployment upgrade - 1.3 to 2.1

Jason Kunst — Mon, 11 Dec 2017 20:44:31 GMT

Agree with paul!

Re: ISE distributed deployment upgrade - 1.3 to 2.1

dot1x — Mon, 11 Dec 2017 21:47:17 GMT

Thanks Paul.

What happens to the license when we use this approach?

Would it retain the licenses?

Re: ISE distributed deployment upgrade - 1.3 to 2.1

paul — Mon, 11 Dec 2017 21:49:41 GMT

It won’t retain the license. You just need to rehost the licenses. I usually must email licensing@cisco.com<mailto:licensing@cisco.com>. They are very responsive.

Re: ISE distributed deployment upgrade - 1.3 to 2.1

gbekmezi-DD — Mon, 11 Dec 2017 22:00:30 GMT

My experience is the device ID doesn’t change if you are using the same VM so you should be able to reuse the same license files if you still have them. Otherwise, rehosting certainly works.

George

Re: ISE distributed deployment upgrade - 1.3 to 2.1

dot1x — Mon, 11 Dec 2017 22:15:29 GMT

I'm fairly new to this, could you pelase have a look and advise if my understanding is correct?

Kick out secondary admin node from the old deployment.

Manually de-register Secondary Admin Node and take back up of this secondary admin node?

Fresh build it to the desired version

Using this?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/install_guide/b_ise_InstallationGuide21/b_ise_InstallationGuide21_chapter_010.html#task_C60EBD3F53714C7BA83DC2E691E4FC1B

Restore data from old version

Restoring the back up taken in Step 1 for Secondary Admin Node?

Verify restored data. This node now becomes the anchor point of the new version deployment.

One at a time rebuild each PSN by installing a fresh build of the new version

At this point of time, do I de-register old PSNs one by one?

Join the PSNs to the new deployment

Finally rebuild what was the primary admin node of the old deployment and join it to the new deployment

Should I take backup of Primary Admin node and then restore to new deployment? At this point of time, this will become secondary admin node in new deployment?

Move personas around as needed