topic Re: ISE 2.7 VM Migration to new VM Host in Network Access Control

ISE 2.7 VM Migration to new VM Host

fatalXerror — Tue, 29 Mar 2022 07:14:11 GMT

Hi Guys,

I believed that we only have an option to migrate ISE VM from one host to another host using cold migration. But I am not sure what should be the proper procedure for this type of migration as I cannot find any from Cisco.

Is cold migration means that I need to have a full backup of the ISE and restore it on the new VM host server with the same specification? or are there proper procedures?

Thanks

Re: ISE 2.7 VM Migration to new VM Host

Kasun Bandara — Tue, 29 Mar 2022 07:18:14 GMT

check this

https://community.cisco.com/t5/network-access-control/migrate-to-new-ise-server/td-p/3703083

Re: ISE 2.7 VM Migration to new VM Host

Mike.Cifelli — Wed, 30 Mar 2022 12:30:04 GMT

Is cold migration means that I need to have a full backup of the ISE and restore it on the new VM host server with the same specification?

-Not sure what version you are running, but if you are talking about migrating an ISE VM from one server in a cluster to another server that will host the ISE VM in the same cluster, then a cold migration would look like this:

$app stop ise --gracefully shutdown services

$halt --shutdown system

migrate node to new server

power ISE vm up

wait for services to come up (to verify $show app status ise)

FYSA in older versions (2.x) only cold migration is supported (this is documented or should be in most install guides) example: See VMware Virtual Machine Requirements: Cisco Identity Services Engine Installation Guide, Release 2.7 - Cisco Secured Network Server 3500/3600 Series Appliances and Virtual Machine Requirements [Cisco Identity Services Engine] - Cisco

Apparently as of 3.1 hot migration is supported. See VmWare Virtual Machine Requirements section: Cisco Identity Services Engine Installation Guide, Release 3.1 - Cisco Secured Network Server 3500/3600 Series Appliances and Virtual Machine Requirements [Cisco Identity Services Engine] - Cisco

Lastly, for cold migration make sure you do it in an outage window. HTH!

Re: ISE 2.7 VM Migration to new VM Host

fatalXerror — Tue, 05 Apr 2022 06:32:35 GMT

Hi @Mike.Cifelli , thanks for the update.

May I ask what do you mean by this --> migrate node to new server? You mean full backup of the ISE then load it to the new VM server?

Sorry, this is my first time migrating a VM ISE from old VM server to new VM server.

Thanks

Re: ISE 2.7 VM Migration to new VM Host

Mike.Cifelli — Tue, 05 Apr 2022 12:49:37 GMT

May I ask what do you mean by this --> migrate node to new server? You mean full backup of the ISE then load it to the new VM server?

-I was providing guidance on how to migrate a vm (without creating new vm) between server hosts in a cluster. Things like vMotion accomplish this by allowing a vm to move between physical hosts. I would suggest engaging your server team for assistance. HTH!

Re: ISE 2.7 VM Migration to new VM Host

fatalXerror — Thu, 07 Apr 2022 01:53:41 GMT

Hi @Mike.Cifelli , thanks for the update.

Because I have new server that will be hosting the new VMs in my new DC, the plan is to migrate all existing VMs from old server to the new server. For the ISE, I believed it supports only cold migration.

Can you share how can I do a cold migration for ISE from old VM server to new VM server?

Can I just do a full backup from my existing ISE then create a new VM in my new server then restore the configuration there and manually import the certificates?

Thanks for your inputs.

Re: ISE 2.7 VM Migration to new VM Host

Marcelo Morais — Thu, 07 Apr 2022 03:32:32 GMT

Hi @fatalXerror ,

please take a look at the following post: ISE 2.7 on BE7M-M5-K9.

Hope this helps !!!