topic Backup / restore ISE upgrade 2.7 to 3.2 in Network Access Control

Backup / restore ISE upgrade 2.7 to 3.2

Darkmatter — Tue, 14 Mar 2023 17:55:47 GMT

So today, i tried to upgrade our current ISE 2.7 to 3.2 with OVA deployed to a new VM and then did a restore config + import certificates so i could reuse ip address and hostname (after deregistering the secondary node and powering off)

Goal was to upgrade to 3.2 without impacting our current production systems and have an easy rollback scenario. (poweron the old machines again)

Ended up with a machine not able to login anymore (despite admin password reset was done as well) and it looked like the restarting services were looping.

I have to erase the VM and start all over again.

Someone has experience with this? Or is it even possible to go straight to 3.2 or not?

Or do you maybe have to go to 3.0, restore config backup and then upgrade to 3.2?

Re: Backup / restore ISE upgrade 2.7 to 3.2

Charlie Moreton — Tue, 14 Mar 2023 20:59:47 GMT

2.7 => 3.2 is a supported and tested single path upgrade.

please work with TAC to diagnose the cause and if a bug will need to be created.

Re: Backup / restore ISE upgrade 2.7 to 3.2

Tariq Mahmoud — Wed, 15 Mar 2023 12:27:05 GMT

I have few questions:
1. Are you sure that the provided resources are sufficient for this VM? having not enough resources can cause the server to go into initializing state.
2. At what stage did the server go into initializing state? is it before restoring the backup or after?
3. Is there any kind of network traffic directed at this node while you are doing it's setup, backup restore, ..etc ?

First, identify if happens before/after restoring the old backup, then build your troubleshooting path based on that.
You will need to collect:
1. Support bundle from the new node.
2. Check if there are core files, from CLI: dir disk:/corefiles/

Re: Backup / restore ISE upgrade 2.7 to 3.2

Darkmatter — Thu, 16 Mar 2023 19:50:25 GMT

Must have had an off day, because giving it a second try and restarting from scratch gave me no issue anymore.

I must say i did my restore in a little bit of different way, where i first made sure my extra interfaces were configured (that i used in the restored config) and also double checked if my imported signed system certificate was active (the default will make ISE's self-signed certificate the active one)

After that, zero issues with the install/patching and restore, and life was good again!