topic Re: how to migrate ISE to new servers in Network Access Control

how to migrate ISE to new servers

tachyon05 — Thu, 24 Dec 2020 18:56:59 GMT

We have SNS-3415-K9 at each branch office and a pair of SNS-3495-K9 at our Headquarters. The branch office servers run policy service persona only, while the 2 HQ servers back up each other and run both the administration and monitoring in addition to the policy service personas. We are running the highest software version the existing hardware can support, 2.3.0.298 patch 7. We have placed an order for a number of SNS-3615-K9 to replace the existing hardware. Each remote office will still get only 1 new server to replace the old one, but HQ will get 4 new servers to replace the current 2 servers. How would you migrate the cluster from the old to the new servers?

Re: how to migrate ISE to new servers

Mark Elsen — Fri, 25 Dec 2020 08:18:30 GMT

- Check this thread for advices and hints :

https://community.cisco.com/t5/network-access-control/migrate-to-new-ise-server/td-p/3703083

Re: how to migrate ISE to new servers

hslai — Sun, 27 Dec 2020 07:43:50 GMT

Adding to marce1000's...

as SNS 36x5 appliances do not support ISE 2.3 and ISE 2.3 has reached the end of support on 2020-June-17, please review the upgrade journey of the target ISE release at ISE Install and Upgrade Guides

Re: how to migrate ISE to new servers

tachyon05 — Tue, 29 Dec 2020 17:22:14 GMT

Thanks for your replies. Since I have new servers to replace every old servers, is there a way to stand up the new servers into a brand new ISE cluster and cutover from the old to new cluster in phases? For example, can I point access switches on one floor / building at a time to the new cluster with multiple maintenance windows, Or is it recommended to cutover the entire enterprise (by reconfiguring all access switches everywhere to point to the new cluster) inside 1 big maintenance window? Will end users devices be able to connect to network as usual, or is user intervention needed (perhaps to accept / trust a new certificate)?

I have 2 nodes at HQ
ISE-HQ-1 (primary admin / secondary monitoring / PSN)

ISE-HQ-2 (secondary admin / primary monitoring / PSN)

I also have branch offices with just 1 PSN

ISE-branch-01 (PSN)

ISE-branch-02 (PSN)

ISE-branch-xx (PSN)

Re: how to migrate ISE to new servers

Marcelo Morais — Thu, 31 Dec 2020 07:05:08 GMT

Hi @tachyon05

1. SNS-36XX appliances MUST be running ISE 2.6+.
2. test the new SNS-36XX and ISE version on a LAB SW first
3. I suggest at least two maintenance window:
 a. the first is a % of your Enterprise (5%, 10% or other)
 b. the second, third, etc is the rest of you Enterprise.

Hope this helps.

Re: how to migrate ISE to new servers

tachyon05 — Mon, 04 Jan 2021 16:01:22 GMT

Thanks. That is what I like to do, however, I am trying to determine what happens to users' devices as they physically move between old and new ISE. For example, he goes from a floor/building on the old ISE to a floor/building on the new ISE, and vice versa.

Re: how to migrate ISE to new servers

Marvin Rhoads — Fri, 01 Jan 2021 03:51:05 GMT

Build out your new ISE deployment using the all new appliances. It should be configured using a backup of the existing deployment's configuration. So all policies, NAD definitions etc. will match. Use 90 day licensing to start.

Put the new servers all in place - the only difference is that they will have new addresses temporarily. Then decommission each old server starting with the remote PSNs. As you do that, change the address of the new PSN to match. End users and network access devices should not see any change in behavior and users should not have to do anything differently for a basic 802.1X deployment.

If you are currently using device registration or guest services, there would be some considerations to account for that depend on the particulars of your deployment.

Your server certificates are also another consideration. As long as you are using CA-issued certificates and allowing the clients to trust them automatically (and haven't, for example, specified particular servers in the 802.1X supplicant configuration) it should be OK. Some more complex issues may arise depending on how you have issued the node certificates (wildcard or other approaches).

Once you've decommissioned the old servers, migrate that deployment's licenses to the new one.

Re: how to migrate ISE to new servers

tachyon05 — Mon, 04 Jan 2021 18:38:54 GMT

Thanks for the detailed reply. We have CA issued certs on the old servers that will expire in a few month. In the past, users always see some popups and have to accept the new certs whenever we renew ISE certs. Would it make sense to use CA issued new certs on the new servers (with new and permanent IPs and hostnames), so users see those popups the first time their devices connect to a floor/building that has been cutover to new ISE? And if they go back to a floor/building that is still on the old ISE, they won't see any popups and their devices would auto connect successfully since they have seen and accepted the certs on the old servers in the past?

Re: how to migrate ISE to new servers

n.elms — Tue, 12 Sep 2023 15:55:23 GMT

Hi Marvin, Old post but useful as I'm facing this scenario now. Can you clarify some items for me please - you mention building all 5 new servers for the deployment (2 x PAN appliances and 3 x PSN VMs) and restoring each node from backup with a temporary IP, then decommissioning the current and changing IP on the new node. My questions:

1 - Does decommission = shutdown the current node and then re-IP the new node to the current ones IP. I take it rollback would be just power the shutdown node back up?

2 - Viewing this method as being similar to a hardware failure recovery would the restore from backup operation do everything required (minus IP restore) to not require the node to be registered again to the PAN/AD?

3 - If PSNs are done one at a time and then the PANs one at a time too I believe always having one active PAN holding all the config means it should all just work or am I thinking too simply?

Thanks in advance for your response!

Re: how to migrate ISE to new servers

Marvin Rhoads — Wed, 13 Sep 2023 13:16:22 GMT

@n.elms yes/correct for all three questions.

Re: how to migrate ISE to new servers

n.elms — Wed, 13 Sep 2023 14:05:30 GMT

Star man! Thanks for the quick response. Much appreciated @Marvin Rhoads!

Re: how to migrate ISE to new servers

n.elms — Mon, 02 Oct 2023 10:36:39 GMT

Hi Marvin, The ISE PAN is the only 'proper' backup created in the deployment as it holds all the config for the deployment and for the PSNs we have the ADE-OS CLI config backed up.

So am I right in thinking that a fresh ISE install with 90 day eval license followed by the ADE-OS CLI config restored and certs from the node to be replaced installed via Web-UI will be enough for this node to come back into the deployment as the old node it is replacing (which will be shutdown)?

As in does the PAN poll/connect to the node and apply the config/policy as the PAN drives everything?

Thanks!

Re: how to migrate ISE to new servers

Marvin Rhoads — Mon, 02 Oct 2023 14:02:53 GMT

@n.elms yes the Primary Policy Administration Node (PPAN or PAN is it's commonly called) "drives" everything. When you restopre a backup and certificates from the old deployment onto it it will have everything needed to assume the role as PPAN is a new deployment. To migrate any old nodes to that deployment, you would need to deregister them from the old and then join to the new (or just build net new VMs).

Re: how to migrate ISE to new servers

n.elms — Mon, 02 Oct 2023 14:11:41 GMT

Thanks Marvin, So at present our plan is to do the PSNs first which is what my query relates to as there is no PSN backup. I have installed a new VM to same level as current hardware to be replaced. So now I need to down the hardware and get the VM in as its replacement on the same IP/name - what is the best patch for this? As mentioned before it's replicating a hardware failure scenario and recovering to a VM.

Re: how to migrate ISE to new servers

hslai — Fri, 06 Oct 2023 21:43:14 GMT

@n.elms Since ISE 3.2 is our current recommended release, please use ISE 3.2 Patch 3 if all possible.

For ISE policies and elements, a secondary ISE node gets a copy of them from the primary ISE after it is registered to the ISE deployment, restarted, and synchronized. So, no PSN backup. However, for PSNs, please do the following:

Take a note of the services enabled on each PSN
Take a note of the profiling probes enabled on each PSN
Take a note of the node group membership of each PSN
Export the server certificates with the corresponding private keys of each secondary ISE node.
Engage AD team to join the new ISE nodes to Active Directory if needed.
Take a note of any other configurations specific to each ISE node, such as IP addresses, DNS, NTP, and static IP hosts entries.

Re: how to migrate ISE to new servers

n.elms — Mon, 09 Oct 2023 08:01:35 GMT

Thanks @hslai, the migration of the install is to facilitate a migration to 3.2 patch 3.

For the PSN migration, Marvin mentioned we can shutdown and bring back a PSN quite simply (like in a failure scenario) - how would you tackle replacing a PSN so we don't have to reconfigure all switches/wireless etc. My thought was treat it as a failure - so whats the best way to recover a PSN?

The latest our hardware supports is 3.1 so we will migrate PSNs to VMs from SNS-3515 appliances then the whole deployment will be upgraded to 3.1 patch 7. The PPAN and SPAN will me migrated from SNS-3595 to SNS-3755 and then final upgrade to 3.2 patch 3.

Re: how to migrate ISE to new servers

gizasystems — Thu, 19 Oct 2023 08:43:44 GMT

Hello Marvin,

Is there an option to edit in the Backup file?

Best Regards

Re: how to migrate ISE to new servers

Marvin Rhoads — Thu, 19 Oct 2023 12:47:09 GMT

@gizasystems you cannot edit the backup file in any meaningful way that would result in a usable backup.