topic Re: Configuration backup, what does it contain? in Network Access Control

Configuration backup, what does it contain?

dgaikwad — Fri, 09 Sep 2022 12:57:10 GMT

Hi Experts,
Planning to perform a backup and restore upgrade from version 2.2 to 2.7.

Before I could start performing this action, wanted to understand what does the configuration backup capture.
What are the other backups that I would be needed to capture for the upgraded version?

Re: Configuration backup, what does it contain?

ahollifield — Fri, 09 Sep 2022 14:37:40 GMT

You really should look at starting over manually if the policy sets aren't too involved. The ISE policy engine changed completely in ISE 2.3 and your 2.2 policies will be automatically converted and most likely will be a total mess.

The backup contains everything you need to restore (including the ADE-OS information if you choose to restore that).

Re: Configuration backup, what does it contain?

Marvin Rhoads — Fri, 09 Sep 2022 18:39:17 GMT

Whether or not you follow @ahollifield 's suggestion you will also need the system certificates from the current deployment. The ISE Upgrade Guide is quite thorough in telling you what to do and in what order. If you folllow carefully it will serve you well.

Re: Configuration backup, what does it contain?

ahollifield — Fri, 09 Sep 2022 19:11:29 GMT

Also some more links to help:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/upgrade_guide/Upgrade_Journey/HTML/b_upgrade_method_2_7.html

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

Note that 2.7 does have an EOL announced^^^ ISE 3.1 is currently the Cisco suggested release.

Re: Configuration backup, what does it contain?

dgaikwad — Sat, 10 Sep 2022 18:26:45 GMT

Yes, did a little experiment to find out and seems that the old 2.2 version policy sets were converted to new policy sets of 2.7.
Also, while doing the restore using command line, there was no option provided to restore the ADE-OS configuration.

What would be command to restore ADE-OS configuration as well?

Re: Configuration backup, what does it contain?

Greg Gibbs — Sun, 11 Sep 2022 23:32:41 GMT

The 'include-adeos' option is available after the password as shown in the CLI Reference Guide.

Re: Configuration backup, what does it contain?

dgaikwad — Mon, 12 Sep 2022 07:34:19 GMT

The restore for the backup was successful and what I see is that as per the new policy set, it just created that many policy sets as there were authentication policies on the older version.
Like 04 authentication policies create 04 policy sets with all the authorization rules copied to them.

So clean up will be another project in itself!

Re: Configuration backup, what does it contain?

dgaikwad — Mon, 12 Sep 2022 09:54:23 GMT

Now that I have already restored the configuration backup and would like to only restore the ADE-OS configuration.
If I proceed with the same command, then it will restore everything that is there in the backup...
Any idea how to restore only the ADE-OS backup now?

Re: Configuration backup, what does it contain?

ahollifield — Mon, 12 Sep 2022 11:03:05 GMT

Yes, that is to be expected when coming from 2.2 and earlier. That’s why I mentioned my preference is just to re-write from scratch when possible.

Re: Configuration backup, what does it contain?

ahollifield — Mon, 12 Sep 2022 11:08:05 GMT

You cannot. It must be done at the time of restore. You will need to restore the entire backup again and include that option.

Re: Configuration backup, what does it contain?

dgaikwad — Mon, 12 Sep 2022 12:43:33 GMT

Makes sense and in case where I need to only restore the ADE-OS configuration?
Is that similar to changing the running config with another config file?

Re: Configuration backup, what does it contain?

Marvin Rhoads — Mon, 12 Sep 2022 12:48:46 GMT

The ADE-OS configuration is quite minimal and often just as easily restored from the cli. It's what you see when typing "show run" at the cli.

Re: Configuration backup, what does it contain?

dgaikwad — Mon, 12 Sep 2022 12:52:23 GMT

I am trying to find such a document for it, but not able to find any.
Could you please point me to one if you have one handy?