topic Re: CIsco ISE upgrade decrease in node size in Network Access Control

CIsco ISE upgrade decrease in node size

bernards — Mon, 10 May 2021 09:14:59 GMT

Has anyone upgraded from a 4 node ISE cluster with Primary and secondary Admin/Mnt nodes and two PSN nodes to the following

2 node cluster with primary/secondary Admin/Mnt/PSN persona

Is the best way to do a fresh build and config or will backup and restore work from a 4 node cluster to a new 2 node cluster

thanks

Re: CIsco ISE upgrade decrease in node size

Marcelo Morais — Mon, 10 May 2021 11:29:42 GMT

Hi @bernards ,

a Backup & Restore is the recommended method.

Please take a look at: Cisco ISE 2.7 Upgrade Guide - Upgrade Method, search for Upgrade Cisco ISE Deployment Using Backup and Restore Method (Recommended).

Hope this helps !!!

Re: CIsco ISE upgrade decrease in node size

bernards — Mon, 10 May 2021 13:00:24 GMT

Hi @Marcelo Morais

thanks for the reply. The only slight concern is with backup and restore from a 4 node cluster into a 2 node cluster. Not to sure if this can be done as its not like for like

thanks

Re: CIsco ISE upgrade decrease in node size

Damien Miller — Mon, 10 May 2021 15:10:10 GMT

From an ISE perspective this can actually be quite easy. You can just enable the PSN persona on the current Admin/Monitoring nodes. Once that's done, you can migrate a few NADs to test, and if all goes well, migrate all the rest.

Once all of the NADs are using the new PAN/MNT/PSN combo nodes, you can decommission the two PSNs you no longer want.

Officially speaking, a four node/four psn deployment is not supported, but it works and migration activities such as this are the only time I would recommend it since you won't be keeping it that way.

The other option is to resize your PSN disk space with a fresh install of those two nodes, then inline upgrade everything as is, ending off by enabling the admin/MNT on the existing PSNs. This would mean you don't have to migrate the NADs to use new radius server IPs. Since you need 600+ gb disk space, your PSNs might need more, hence the reinstall that might be required.

Re: CIsco ISE upgrade decrease in node size

craiglebutt — Mon, 10 May 2021 15:13:28 GMT

I see what you are getting at.

Surely it will say there are 2 missing nodes, which you should be able to delete.

I've got to do this in few weeks time from 6 psn to 4 psn

cheers

Re: CIsco ISE upgrade decrease in node size

bernards — Tue, 11 May 2021 06:22:14 GMT

@Damien Miller

Thanks for the reply

I did think that this could be the only way forward. Once done I suppose a few network changes then will point to the different addresses for the new 2 node PSN cluster.

I will post the outcome of the migration for reference once complete