topic Re: Upgrade the ISE on 2 nodes (active/stand by) in Network Access Control

Upgrade the ISE on 2 nodes (active/stand by)

msompong1 — Tue, 06 Apr 2021 10:27:42 GMT

Hi All,

I've the plan to upgrade ISE from 2.3 to 2.7 from my 2 nodes VM (active/standby).

Could you please advise can I do it without the downtime?

Thank you.

Re: Upgrade the ISE on 2 nodes (active/stand by)

Marcelo Morais — Tue, 06 Apr 2021 12:00:49 GMT

Hi,

take a look at the following link: ISE Upgrade Journey, Release 2.7. and ISE Compatibility Matrix for 2.7.

Have the following in mind to better understand your downtime:

1. RHEL for 2.3 is 7.0, for 2.7 is 7.6. (more time for the upgrade process)

2. ISE 2.7 supports the following Hardware Platform: 35XX and 36XX (double check the VM Appliance Recommendation, maybe you need to add extra CPU, Memory or HDD)

3. run the URT (Upgrade Readiness Tool) before the upgrade to identity any issue that might cause an upgrade failure.

Hope this helps !!!

Re: Upgrade the ISE on 2 nodes (active/stand by)

Damien Miller — Tue, 06 Apr 2021 13:25:38 GMT

You could do it with minimal downtime, but I wouldn't say zero downtime.

Assuming you upgrade the secondary and that goes well, it becomes the new 2.7 primary. Then you will upgrade the old 2.3 primary to be the 2.7 secondary, this upgrade process in itself is essentially downtime free from an end user perspective. The downtime will come when you want to swap the primary and secondary PAN rolls back to their original positions, both nodes will reload and you'll have about a 10 minute outage during the PAN swap.

Re: Upgrade the ISE on 2 nodes (active/stand by)

msompong1 — Thu, 08 Apr 2021 04:32:11 GMT

Thank you Damien,

So during the upgrade not require the de-register the node right?

Can I say it like this?

1.Backup the config and operation data on the primary node.
2.Run the URT on the secondary node
if it passes then
3.Upgrade to 2.7 from secondary node with CLI
4.Patch the upgrade in the secondary node to the latest patch version.
5.Re-do the step 3 and 4 on the primary node.

Re: Upgrade the ISE on 2 nodes (active/stand by)

msompong1 — Thu, 08 Apr 2021 04:32:58 GMT

Thank you Marcelo for the good information.