topic Re: ISE Upgrade (Hw & Sw) in Network Access Control

ISE Upgrade (Hw & Sw)

Alvaro Luiz Maia Motta — Wed, 05 Jan 2022 20:53:31 GMT

Hello folks, greetings.

Our customer has a pair of ISE 2.2 (PRI(PAN, PSN & MnT) and SEC(PAN, PSN & MnT)) running on old hardware and they have purchased a pair of new UCSs to migrate the deployment. Besides the hardware migration, they want to upgrade the deployment to version 2.7 as well.

We have seen a ton of documentation, but could not find any that would involve hardware upgrade along with the ISE upgrade.

We are considering the following strategy:
1 - Upgrade the current environment to version 2.7
2 - Install a fresh copy of version 2.7 on the new hardware
3 - Add both nodes to the existing deployment
4 - Remove the old nodes.

Is it feasible? Would the final deployment be clean of version 2.2 traces? Any better recommendation?
Should the outlined strategy be more secure and straightforward, what would be the precautions we would have to take in regards to certificate and how can we transfer the licenses of the current nodes to the new ones?

We'd appreciate any help.

Thanks in advance,

Re: ISE Upgrade (Hw & Sw)

Marcelo Morais — Wed, 05 Jan 2022 22:12:32 GMT

Hi @Alvaro Luiz Maia Motta ,

yes, it's a good Action Plan.

Remember that at the end of the day the Serial Number (check it at Administration > System > Licensing - check the UDI Details) of the ISE Cube will be the new PAN Serial Number.

Note 1: remember that ISE 2.7 supports restore from backups obtained from Release 2.2 and later, in other words, you are able to install a fresh copy of 2.7 on the new hardware and restore the backups.

Note 2: ISE 2.7 P6 is a good patch.

Hope this helps !!!

Re: ISE Upgrade (Hw & Sw)

Marvin Rhoads — Fri, 07 Jan 2022 13:29:20 GMT

If they purchased just UCS servers (and not SNS-36x5 ISE servers) then they cannot install ISE directly onto the bare metal servers - they must first install ESXi and then run ISE as a VM. If running as a VM then VM licenses are required.

As far as version, 3.0 patch 4 is currently recommended as Gold Star.

Re: ISE Upgrade (Hw & Sw)

Peter Koltl — Sat, 08 Jan 2022 21:17:27 GMT

The simplest way is to fresh install 3.0 on the new hardware, then restore the configuration from 2.x backup. Even IP addresses and hostnames can be identical if you can provide an isolated environment.

Re: ISE Upgrade (Hw & Sw)

Alvaro Luiz Maia Motta — Mon, 10 Jan 2022 13:44:17 GMT

Hi Marcelo, greetings!

Thanks for your reply. Apparently the restore 2.2 on top of a clean 2.7 would be the best option.

Any difference in upgrading the 2.2 to the latest patch (17) before backing up?

Once again, thanks a zillion!

BR,

Re: ISE Upgrade (Hw & Sw)

Alvaro Luiz Maia Motta — Mon, 10 Jan 2022 13:53:14 GMT

Hi Marvin, greetings!!

Thank God they have purchased the ESXi and ISE VM licenses.😊

Thanks and have a great week!

Re: ISE Upgrade (Hw & Sw)

Alvaro Luiz Maia Motta — Mon, 10 Jan 2022 13:59:35 GMT

Hi Peter, greetings.

For some reason, they cannot go to 3.x now. Apparently they need to do some upgrade before. We'll investigate on the requirements and maybe there is no need to have 2.7 temporarily.

Thanks,

Re: ISE Upgrade (Hw & Sw)

Marcelo Morais — Mon, 10 Jan 2022 15:34:42 GMT

Hi @Alvaro Luiz Maia Motta ,

two notes:

1. ISE 3.0: supports restore from backups obtained from Release 2.4 and later.

2. "Any difference in upgrading the 2.2 to the latest patch (17) before backing up?"

ISE 2.7.0 parity with ISE 2.2 P15, 2.3 P7 and 2.4 P10 and 2.6 P2 ... IMO, if my ISE is 2.2 P15 or later, then I'm good to backup and restore without problems, if not, then I always prefer to update before backing up (this is what I do) !!!

Hope this helps !!!

Re: ISE Upgrade (Hw & Sw)

Alvaro Luiz Maia Motta — Mon, 10 Jan 2022 20:59:29 GMT

Hi Marcelo,

Since they have 2.2 P16, I guess we're good to go from there.

Thank you very much for helping us to save a few hours.

BR,