topic Re: Migration to ISE 2.7 in Network Access Control

Migration to ISE 2.7

fatalXerror — Wed, 05 Aug 2020 14:39:26 GMT

Hi Guys,

I am planning to migrate my old ISE running in my old server to a new ISE 2.7 that will be running in the new SNS server. Both old and new ISE are running in HA.

What I planned so far are;

1. Configure temp IP address to the ISE 2.7 and form the cluster.

2. Configure the ISE 2.7 settings and policies based on the old ISE.

3. Pilot testing first to the new ISE 2.7.

4. Once testing are good, disconnect the old ISE and change the IP address of the ISE 2.7 to the IP address of the old ISE.

My concern is item number 4, this means that I need to break the cluster right? If I need to break the cluster and form again the cluster, will the other configuration such as the NADs and policies will be deleted?

Thank you very much for the help.

Re: Migration to ISE 2.7

Jatin Katyal — Wed, 05 Aug 2020 16:36:26 GMT

What is the version / platform and how many nodes you have in the old deployment ? Are you moving from EoL SNS appliance like 34x5, 35x5 to 36x5 appliance environment ? Are you going to have same number of nodes in the new ISE deployment ? While I am looking for your update on above questions. I can tell that nothing will be deleted in your new deployment if you backup the configuration from your OLD ISE deployment and restore successfully on the NEW ISE deployment.

Re: Migration to ISE 2.7

fatalXerror — Thu, 06 Aug 2020 04:41:37 GMT

Hi @Jatin Katyal ,

I am changing old SNS hardware and old ISE version to new SNS hardware to the newly ISE 2.7. I am not able to usethe backup and restore function since the old ISE is using 1.x version which means I will be manually configuring the settings from the old to the new ISE 2.7.

About my concern since this is a manual migration, I want to test out first the ISE 2.7 that is why I configured a temporary IP in it and setup everything that will be same like as the old ISE. Then once I am good about the testing, I will be changing the temporary IP address to be the production IP address, do I need to destroy the cluster and the AD integration for this to work or just simple change the IP address in the ISE 2.7 CLI nodes will be fine?

Thanks

Re: Migration to ISE 2.7

Greg Gibbs — Thu, 06 Aug 2020 07:51:50 GMT

As documented in the Install Guide, the node must be in Standalone mode before changing the IP address. If the node is part of a cluster, you must de-register it before changing the IP address.