topic Re: ISE config backup restore from a different node in Network Access Control

ISE config backup restore from a different node

joseponceiii — Tue, 09 Mar 2021 03:23:13 GMT

Hello,

So we have an ISE lab environment that has been corrupted and needed a rebuild. Do someone know if I can restore from the production node (different hostname, IP,) but all policies where the same? What I exactly mean is, when restoring from a backup, I'd like to know if the hostname and IP were also being restored from the config? I asked this, I was wondering if I can just restore from a production environment to our lab and not interrupt the authentications since it will use the same hostname and IP etc of the production one (if that's the case).

Thanks,

Re: ISE config backup restore from a different node

thomas — Tue, 09 Mar 2021 16:28:28 GMT

Hostname and IP will be restored.

Please read the ISE Admin Guide for details:

Cisco ISE Restore Operation

Guidelines for Data Restoration

Following are guidelines to follow when you restore Cisco ISE backup data.

Cisco ISE allows you to obtain a backup from an ISE node (A) and restore it on another ISE node (B), both having the same host names (but different IP addresses). However, after you restore the backup on node B, do not change the hostname of node B because it might cause issues with certificates and portal group tags.

Re: ISE config backup restore from a different node

poongarg — Wed, 10 Mar 2021 02:10:16 GMT

You can skip hostname and IP address restore by restoring the configuration backup from CLI and skipping the option "include-adeos"

restore filename repository repository-name encryption-key hash|plain encryption-key name include-adeos

Enter this command operator parameter if you want to restore ADE-OS configuration from a configuration backup. When you restore a configuration backup, if you do not include this parameter, Cisco ISE restores only the Cisco ISE application configuration data.

Re: ISE config backup restore from a different node

joseponceiii — Wed, 10 Mar 2021 03:29:43 GMT

This is exactly what I'm looking for. I've been seeing this "include-adeos" command and not entirely sure if this is I really need to exclude from restore command. Thanks for clarifying. Now, I can test to restore the config of another node using CLI thru the repository.