topic Re: ISE 1.4 -> 2.1 upgrade broken in Network Access Control

ISE 1.4 -> 2.1 upgrade broken

awolf — Wed, 17 May 2017 14:50:53 GMT

I have a customer, University in NY trying to upgrade ISE from 1.4 to 2.1.

They are following the DOCS and it does not complete. TAC has sent them the same docs

but it is not helping. TAC trying to recreate it now. Encryption key not found, etc.

Question: Would it be better to backup 1.4 and restore to 2.1 rather than upgrade in this case?

I don't know if that would lose any information.

Thanks for any input from your experiences.

-Andy

Re: ISE 1.4 -> 2.1 upgrade broken

Timothy Abbott — Wed, 17 May 2017 14:54:28 GMT

You shouldn't lose any information if you restore from backup. Just be sure to install the latest patch for 2.1 prior to the restore.

Regards.

-Tim

Re: ISE 1.4 -> 2.1 upgrade broken

awolf — Wed, 17 May 2017 15:30:17 GMT

Thanks Tim.

Much appreciated.

-Andy

Andy Wolf

KC3IMB

Wireless / Mobility Consulting Systems Engineer

CCIE # 2049, CISSP

Cisco Systems

awolf@cisco.com

717.760.5269 (w)

717.439.4937 (m)

Re: ISE 1.4 -> 2.1 upgrade broken

Jason Kunst — Wed, 17 May 2017 15:33:17 GMT

Make sure 1.4 is on latest patch as well before the backup

Re: ISE 1.4 -> 2.1 upgrade broken

awolf — Wed, 17 May 2017 15:43:29 GMT

Thanks Jason. Good point!

-Andy

Re: ISE 1.4 -> 2.1 upgrade broken

paul — Wed, 17 May 2017 21:47:21 GMT

Andy,

Just as a note doing a fresh build and restore is how I do all my upgrades. One of the methods I like to use is have the customer spin up a temporary VM that I use as the anchor point for the new version of code. I fresh install the new version, patch it and then restore the backup. Then I will do testing against the new VM to make sure the rules work as expected.

Now that I have a good anchor point for the new code, I simply need to rebuild each ISE node add them to the new deployment and shuffle around personas. Very controlled and easy way to do the upgrades.

At the end the VM either gets retired or they pay for a VM license and turn it into their lab ISE server if they don't already have one.

Re: ISE 1.4 -> 2.1 upgrade broken

Charlie Moreton — Thu, 18 May 2017 13:55:12 GMT

You have likely already seen this, but in case you haven't it could be helpful:

Upgrading to Identity Services Engine 2.1 in a Distributed Environment