topic Re: Upgrading from Medium to Large Deployment in Network Access Control

Upgrading from Medium to Large Deployment

jugdip.virdi — Wed, 22 Mar 2017 23:11:48 GMT

Hello,

Is there a documented process for upgrading a deployment from medium to large for version 2.1?

Many thanks

Re: Upgrading from Medium to Large Deployment

thomas — Thu, 23 Mar 2017 15:42:25 GMT

We have videos talking about Upgrades from 1.4 and 2.0 under Upgrades :

ISE 2.0 to 2.2 GUI Upgrade - YouTube

ISE 1.4 to 2.0 Upgrade - YouTube

Going from a Medium to a Large deployment is a Scaling exercise and not a software Upgrade.

Please refer to ISE 2.2 - Network Deployments in Cisco ISE which talks about the different deployment sizes.

I think what you are asking his how to migrate from PAN+MNT nodes to separate PAN & MNT nodes.

You will want to remove/uncheck the PAN or MNT role from the secondary PAN+MNT then add a new ISE node as a that role and allow it to synchronize.

You will need to do the same for the other roles that you want to split out.

Re: Upgrading from Medium to Large Deployment

jugdip.virdi — Fri, 24 Mar 2017 07:50:00 GMT

Hi Thomas,

It is splitting the roles out so PAN+MNT. Is this not a documented process as I want to introduce new hardware to ultimately take over the Primary roles the older hardware is doing for the existing PAN or MNT and make the new 3595 primary. Will the licenses transfer successfully as part of the synchronisation or do I need to raise a licensing request?

If it is not documented because it is simple then fine, I thought I would check first.

Thanks for your help.

Juggy

Re: Upgrading from Medium to Large Deployment

thomas — Fri, 24 Mar 2017 16:17:02 GMT

Then you will want to make your new nodes MnTs since the licensing needs to stay with your PANs.

Disable the secondary MnT.

Add the new MnT node as secondary, let it synchronize.

Make the new MnT node the Primary MnT.

Disable the old MnT node.

Add the new MnT node and let it synchronize.

Celebrate.

Re: Upgrading from Medium to Large Deployment

bcotaz — Tue, 02 Aug 2022 08:19:44 GMT

@thomas I'd like to check if we have a document on migration from a Medium Deployment to a Large Deployment available already.

Thank you

Re: Upgrading from Medium to Large Deployment

ahollifield — Tue, 02 Aug 2022 14:41:03 GMT

There is probably a better place to look for this information as Cisco employee than commenting on a public forum post from 5 years ago. That being said, here's what I would do:

Deploy two new Monitor nodes
Disable Monitoring persona on one of the current PAN+MNT nodes
Add new Monitoring node to deployment with MNT persona only
Repeat for additional PAN+MNT/new MNT node.
Deploy new PSNs as needed

Re: Upgrading from Medium to Large Deployment

thomas — Tue, 02 Aug 2022 15:03:34 GMT

I illustrated the process in a recent ISE Webinar:

ISE Deployment Architectures: Nodes, Services and Scale

16:44 ISE Deployment: Standalone ISE Node
17:59 ISE Deployment: Small
19:01 ISE Deployment: Small 3 Node
20:33 ISE Deployment: Medium and Multiple Regions
22:43 ISE Deployment: Medium to Large
23:40 ISE Deployment: Large

Re: Upgrading from Medium to Large Deployment

bcotaz — Wed, 03 Aug 2022 00:39:29 GMT

thank you @ahollifield and @thomas