topic Re: Promote primary PAN to secondary and Vice-versa in Network Access Control

Promote primary PAN to secondary and Vice-versa

Pat Pouna — Wed, 09 Dec 2020 16:59:33 GMT

Team, below is my current deployment:

ISE1 : Admin and MnT personas SEC(A), PRI(M)

ISE2 : Admin and MnT personas PRI(A), SEC(M)

2 PSNs.

In preparation of ISE upgrade from 2.3 to 2.7, I would like to promote ISE1 primary, ISE2 Secondary in order to start the upgrade with ISE2.

I know that promoting the secondary PAN to be the primary involves a whole synch between the two nodes + the application services on both nodes are going to be restarted.

My question is, should I promote the SEC to PRI first, and then change the old PRI to SEC? Is there an order of operation to respect or it does not matter?

Re: Promote primary PAN to secondary and Vice-versa

Damien Miller — Wed, 09 Dec 2020 19:49:33 GMT

You will log in to the current secondary admin node and click "promote to primary", it will also demote the current primary to secondary. There is no additional interaction you need, ISE takes care of the moving the primary role and demoting the existing primary. The only thing you need to plan for is the application services and node reloads, and the associated change window for the outage.

If you wish to move the monitoring node primary/sec, you can do that anytime without end user impact but there is no need to move if unless you want.

Re: Promote primary PAN to secondary and Vice-versa

Pat Pouna — Wed, 09 Dec 2020 20:06:50 GMT

Sounds Good Damien Thanks !

Re: Promote primary PAN to secondary and Vice-versa

Nadav — Tue, 22 Dec 2020 17:22:41 GMT

Initially ISE2 is primary and ISE1 is secondary. Keep in mind that the active PAN is always the first one to be upgraded if you're upgrading via GUI.

So this statement:

In preparation of ISE upgrade from 2.3 to 2.7, I would like to promote ISE1 primary, ISE2 Secondary in order to start the upgrade with ISE2.

Is incorrect since promoting ISE1 to primary means the upgrade would start with ISE1.

If you want full control of your upgrade workflow, you can use CLI and a repository.

Re: Promote primary PAN to secondary and Vice-versa

Pawan Harle — Tue, 31 Jan 2023 20:45:29 GMT

many Thanks for this post