topic Re: How to proceed to update this cluster in Network Access Control

How to proceed to update this cluster

jds5 — Thu, 20 Jan 2022 09:42:35 GMT

Hello,

We will soon be performing an upgrade on one of our ISE clusters.

This cluster currently consists of 11 nodes in total:
- 1 PAN Primary
- 1 PAN Secondary
- 1 MNT Primary
- 1 MNT Secondary
- 8 PSN

Also, we have 3 PSN SNS-3495-K9 which will be replaced by SNS-3615-K9

The other equipment are 3595

The current version of the cluster is 2.1 patch 6 and the target version is 2.7 patch 6

Could you tell me how to update this cluster to the target version 2.7 patch 6?

Thank you,

BR,

José

Re: How to proceed to update this cluster

balaji.bandi — Thu, 20 Jan 2022 11:27:06 GMT

From ISE 2.1 to 2.7 you can not directly upgrade, you need to go 2.2 then 2.7 :

read the release notes check any caveats and supported matrix :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_2_7_pdf/m_upgradeoverview.html

Follow distribuited upgrade :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/upgrade_guide/Upgrade_Journey/HTML/b_upgrade_method_2_7.html

Re: How to proceed to update this cluster

Marcelo Morais — Thu, 20 Jan 2022 12:36:57 GMT

Hi @jds5 ,

beyond what @balaji.bandi said ... one possibility is:

1. De-register the SPAN and SMnT and create a New Cluster with them.

2. Upgrade the New Cluster to 2.2 and then to 2.7 P6

3. De-register one PSN from the Old Cluster, fresh install to 2.7 P6 and register this PSN to the New Cluster

Note: at this point you have a small New Cluster (3x Nodes) with all your data

5. Test the New Cluster, if everything is OK, then start "de-register" a Node from the Old Cluster, fresh install the Node and "register" to the New Cluster

Hope this helps !!!

Re: How to proceed to update this cluster

jds5 — Thu, 20 Jan 2022 15:23:02 GMT

Thank you for your answers.

Regarding the 3615 model, I saw a note that says that to install version 2.4 on it, you must use the following os: ise-2.4.0.357.SPA.x86_64_SNS-36x5_APPLIANCE_ONLY.iso

Until now, no worries, however, it also says in this note to apply patch 9 after installation.
“For Cisco Secure Network Server (SNS) 3600 series appliance support (SNS-3615-K9, SNS-3655-K9, and SNS-3695-K9), you must use only the new ISO file (ise-2.4.0.357.SPA .x86_64_SNS-36x5_APPLIANCE_ONLY.iso).
Cisco ISE 2.4 Patch 9 or above must be applied after installation. We recommend that you do not use this ISO file for SNS 3500 series appliance, VMware, KVM, or Hyper-V installation. »

What does patch 9 bring?

Do I really have to apply it? in which case I have to do it also on the SNS-3595-K9 appliances?

Thank you,

José

Re: How to proceed to update this cluster

balaji.bandi — Thu, 20 Jan 2022 16:27:34 GMT

After you upgrade to 2.2, You directly going to ISE 2.7 right ? why you installing ISE 2.4 ?

Once you installing and up and running ISE 2.7, then you need add patches as per suggestion made by cisco.

Re: How to proceed to update this cluster

jds5 — Fri, 21 Jan 2022 09:42:10 GMT

Hello,

One of my 3615 Appliances is in version 2.4 which must be integrated into the cluster, hence my previous question.

Otherwise, I have another question.

I have in my possession a test appliance (3615) in version 2.4 on which I would like to import a backup of PAN2.1
is it possible ?
If so, will backup change my current ip?

Thank you,

BR,

José

Re: How to proceed to update this cluster

Mark Elsen — Fri, 21 Jan 2022 10:09:55 GMT

>....If so, will backup change my current ip?

- FYI : https://community.cisco.com/t5/network-security/cisco-ise-restore-backup/td-p/4259883

Re: How to proceed to update this cluster

jds5 — Tue, 25 Jan 2022 13:55:39 GMT

Hello,

I have a new question still in the same context. This time, it concerns the CIMC part.

Today to connect to the CIMC of the SNS-3595-K9, it's quite complicated because the web interface still uses Flashplayer.

The current CIMC firmware version is 2.0(9c) and the bios version is: C220M.4.2.0.9a.0.120120151839

Can we update to a 4.0 version like what we can find on an SNS-3655-K9?
If so, do you have the procedure and the recommended version, please?

BR,

José

Re: How to proceed to update this cluster

Mark Elsen — Tue, 25 Jan 2022 15:45:44 GMT

- Ref : https://www.cisco.com/c/en/us/td/docs/security/ise/sns3500hig/b_ise_SNS3500HIG/b_ise_SNS3500HardwareInstallationGuide22_chapter_010.html

>...

You must use the versions of CIMC firmware from the ISE downloads, which are qualified versions for use with the SNS appliances. Versions of CIMC for UCS are not compatible. Newer versions of CIMC are developed for SNS appliances after they are developed for UCS.

- So that will only work if a newer cimc version is offered for the particular sns-model in the ISE downloads section (cisco software downloads) , since SNS-3595-K9 is EOL , doubt this will be possible.

Re: How to proceed to update this cluster

Greg Gibbs — Tue, 25 Jan 2022 22:56:38 GMT

There are CIMC upgrade files and instructions available for the SNS-35xx appliances under the Firmware section of the ISE software downloads.

https://software.cisco.com/download/home/283801620/type/283802505/release/SNS%2035x5

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 09:49:38 GMT

Hello,

Finally, all equipment has been updated to version 2.7 patch 6
Everything seems to be working fine except for the backup/restore menu where it is impossible for us to navigate in it.
This issue is seen with other browsers. We even tried the reboot without success.
Has anyone encountered this type of problem before?

BR,

José

Re: How to proceed to update this cluster

Marcelo Morais — Mon, 07 Feb 2022 10:48:01 GMT

Hi @jds5 ,

in other words, in Administration > System > Backup & Restore, you are unable to click the Edit link of the Schedule Backup and also the Select Repository?

PS.: meanwhile, are you able to generate a manual Backup via CLI?

ise/admin# backup CONFIG-DATA repository <repository> ise-config encryption-key plain <password>

Regards

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 13:45:44 GMT

yes in CLI it works without problem.
It's only web browsing in this menu that doesn't work

Re: How to proceed to update this cluster

Marcelo Morais — Mon, 07 Feb 2022 14:41:31 GMT

Hi @jds5 ,

worth the shot to deregister your SPAN from the ISE Cube (it will become a Standalone Node) to check if the issue will "show up" on the Standalone Node.

Note: if the issue remains, we are able to check the problem in a Node "outside" the Production Cluster.

Hope this helps !!!

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 14:54:43 GMT

Thank you for this suggestion.
I keep you informed.

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 15:47:06 GMT

Could you tell me if there is any impact to making this change, please?

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 16:24:57 GMT

Could you tell me if there is a risk for the production to make this modification, please?

Re: How to proceed to update this cluster

jds5 — Mon, 07 Feb 2022 16:26:00 GMT

could you tell me if there is a risk for the production to make this modification, please?

Re: How to proceed to update this cluster

Marcelo Morais — Mon, 07 Feb 2022 17:38:50 GMT

Hi @jds5 ,

minimum risk, because the SPAN is a standby for you PPAN.

Hope this helps !!!

Re: How to proceed to update this cluster

jds5 — Fri, 18 Feb 2022 17:16:21 GMT

Hello,

Finally, this issue has been solved.

We realized that an old backup directory that was no longer used, we could not delete it.

We reactivated the GUI backup on this location, which allowed it to be deleted later.

This modification solved the initial problem of accessing the backup/restore directory.

Thanks for your help,