topic Re: ISE Logging in Network Access Control

ISE Logging

axa_tech_uk — Mon, 19 Oct 2020 17:14:45 GMT

Hi,

We are working to upgrade our ISE from version 2.0.1

In order to reduce the upgrade time to a reasonable level we have purged data to 40 days worth.

We still have a very long upgrade time.

Currently each of our MNT nodes alone will take 4 hours to upgrade.

Are there other options to reduce this figure?

I presume that an OPS backup would act as a full backup of all logs, is this correct?

Could we therefore, as an option, purge more data and restore it post-upgrade?

Thanks

Re: ISE Logging

Eric Marshott — Mon, 19 Oct 2020 17:37:21 GMT

Create a new ISE deployment on the version you are moving to, migrate all settings and get that deployment working exactly as you need it, then migrate your NADs (e.g WLCs, Router/Switches using TACACS) to use the new AND the old deployment. There is an entire deployment guide for upgrading ISE in this way

Re: ISE Logging

Damien Miller — Mon, 19 Oct 2020 18:58:54 GMT

As you pointed out, you can restore operational data from a backup, but most don't bother. Is there a firm requirement to maintain the historical logging through the upgrade? I often purge as aggressively as I can to maintain the minimum, 1 day, or skip upgrading the MNT and install it new from the ISO.

If you do choose to backup/restore the operational data, keep in mind that you restore it to each MNT node individually.

I assume you are going 2.0.1 to 2.4 if this question is coming up. Have you considered standing up a "new" deployment in parallel on 2.7, potentially powering off the 2.0 node(s) and reusing IPs?

Re: ISE Logging

Andrii Oliinyk — Mon, 19 Oct 2020 19:12:15 GMT

i can just add Damien :0)

backup&restore approach will be your friend

Re: ISE Logging

Peter Koltl — Thu, 22 Oct 2020 21:15:31 GMT

Watching the upgrade for 8 or 12 or 20 hours: why do you regard it as ‘long’ after 5+ years of undisturbed ISE operation?