topic Cisco ISE Migration from 2.4 to 3.1 in Network Access Control

Cisco ISE Migration from 2.4 to 3.1

networker9 — Tue, 07 Mar 2023 08:58:16 GMT

We currently have ISE- 5 node cluster with 2 node for PAN and 3 nodes for PSN and currently running 2.4 version.

We need to upgrade to 3.1 which is currently the suggested stable release.

All integrations like AD, SMS gateway etc are active on the current setup.

Will be deploying on a new set of VM's and would like to use same IP's being currently used.

Need suggestion to the best possible approach to achieve this.

Re: Cisco ISE Migration from 2.4 to 3.1

Rob Ingram — Tue, 07 Mar 2023 09:34:56 GMT

@networker9 Cisco has an offical guide and a webinar on this subject, this covers the different methods available when upgrading and hopefully answers all your questions.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/upgrade_guide/HTML/b_upgrade_method_3_1.html

https://www.youtube.com/watch?v=q2JpC8oNssA

Re: Cisco ISE Migration from 2.4 to 3.1

Charlie Moreton — Tue, 07 Mar 2023 12:30:21 GMT

I detail the procedure to accomplish this in the following video:

Upgrading ISE Using the Backup and Restore Method

Take note that moving from 2.4 to 3.1 will require a 2-step upgrade. See here for details:

ISE Version Upgrade Matrix

Re: Cisco ISE Migration from 2.4 to 3.1

networker9 — Tue, 07 Mar 2023 14:31:27 GMT

Hi Charlie,

Thanks for sharing the procedure.

Does this process need to run the URT tool as well.

As we are directly installing a fresh machine from scratch, not required of any URT tool to run i guess.

Re: Cisco ISE Migration from 2.4 to 3.1

Charlie Moreton — Tue, 07 Mar 2023 14:39:08 GMT

Yes, the URT is recommended to ensure the backup file to be restored has no issues preventing a successful restoration to the new deployment.

Re: Cisco ISE Migration from 2.4 to 3.1

networker9 — Tue, 07 Mar 2023 14:55:15 GMT

So, as per the suggested Backup & Restore Procedure, the steps would be first run the URT tool.

Next collect a fresh backup, de-register the secondary administration node, re-install with 2.6 or 2.7, restore the backup. (This will act as primary but won't function as there are no PSN.)

Next, we will repeat the task on PSN-1 and then can we join the upgraded PAN node. Will there be any interruptions in the service at this point.?

Re: Cisco ISE Migration from 2.4 to 3.1

ahollifield — Wed, 08 Mar 2023 13:47:52 GMT

Are these VMs? I would just re-deploy the PSNs from scratch using the OVA. Impossible to say if you will encounter a service disruption. How are your NADs configured? Do they all point to multiple PSNs? Obviously taking the PSN down for re-deployment will cause it to stop responding to RADIUS/TACACS+ requests.

Re: Cisco ISE Migration from 2.4 to 3.1

networker9 — Fri, 23 Feb 2024 12:55:57 GMT

Hi Charlie,

The upgrade was successful by using backup and restore method.

Thanks for the advise.