topic Re: ISE 2.7 replace PSN node in Network Access Control

ISE 2.7 replace PSN node

densto — Thu, 04 Nov 2021 15:23:56 GMT

Hello,

We are running 6 node ISE 2.7 cluster with 2 Admin nodes and 4 PSN's. I am preparing for 3.0 upgrade and our PSN nodes failed Health check with not enough space. Our PSN nodes were built from 2.4 OVA and at that time disk size requirement were lower at 200 Gb. ISE 3.0 requires 300Gb. My plan is to rebuild all PSN nodes with new 2.7 OVA. Just want to make sure that my steps are correct.

I downloaded new 300 Gb OVA ISE-2.7.0.356-virtual-SNS3615-SNS3655-300.ova

My plan to remove one PSN at a time and rebuild VM fom new OVA and then add it back in to the cluster.

Export all certificates.
Deregister PSN node from ise cluster.
Delete VM
Build new VM from OVA.
Patch it.
Import all certificates in to new PSN.
Add PSN to a ISE cluster and assign appropriate roles.

Thank you,

Denis

Re: ISE 2.7 replace PSN node

JohnMaida05753 — Thu, 04 Nov 2021 17:42:29 GMT

I am about to embark on this as well, but replacing both my nodes due to only a 200gig drive. Those steps are what I had in mind as well. But for deleting the VM. I wondering if I can just create a fresh VHDX and install fresh from the iso.

Re: ISE 2.7 replace PSN node

Marcelo Morais — Thu, 04 Nov 2021 18:46:04 GMT

Hi @densto ,

yes, it is correct.

Note: please double check if you need to rejoin AD.

Hope this helps !!!

Re: ISE 2.7 replace PSN node

densto — Thu, 04 Nov 2021 18:49:19 GMT

Hi John,

I think it would work. you removing existing disk and creating a new one and then reinstalling ISE on it. I have 4 psn nodes so i can sacrifice one at a time.

Thank you

Re: ISE 2.7 replace PSN node

JohnMaida05753 — Thu, 04 Nov 2021 19:54:05 GMT

Would it need to be joined to the domain before I add it to the cluster? or will it join when it gets added?

Re: ISE 2.7 replace PSN node

Marcelo Morais — Thu, 04 Nov 2021 20:11:24 GMT

HI @JohnMaida05753 ,

1st register the Node to the Cluster

2nd check at Administration > Identity Management > Extenal Identity Sources > Active Directory > select you AD > and check the Node Status.

Hope this helps !!!

Re: ISE 2.7 replace PSN node

densto — Fri, 05 Nov 2021 12:56:28 GMT

some observations .

Medium size deployment VM hardware requirements changed. vCPU is up from 16 to 24 RAM from 64Gb to 96Gb.

To provision OVA took 40 minutes and then another 30 min to Install ISE and reboot the VM and 15 min for all services to start.

Re: ISE 2.7 replace PSN node

densto — Thu, 10 Mar 2022 06:55:05 GMT

I changed and added PSN node replacement steps:

Export all certificates.
Deregister PSN node from ise cluster.
Delete VM
Build new VM from OVA.
Patch it.
Add PSN to a ISE cluster and assign appropriate roles.
Import all certificates in to new PSN.
Rejoin AD and test Authentication from new node.
Check Radius Authentication report to validate that devices are able to authenticate with new PSN.