topic ISE 2.7 upgrade to version 3 patch 4 in Network Access Control

ISE 2.7 upgrade to version 3 patch 4

Gouthami Nair — Mon, 10 Apr 2023 12:36:06 GMT

Hi All,

We are currently using Cisco ISE 2.7 version patch 8 and planning to upgrade to version 3.1 Please let me know whether any known issues reported in patch 4 ? Are there any reported issues during the upgrade such as configuration sync etc..

Re: ISE 2.7 upgrade to version 3 patch 4

Marcelo Morais — Mon, 10 Apr 2023 13:30:26 GMT

Hi @Gouthami Nair ,

I didn't have issues from 2.7 P8 (Nov 21th) to 3.1 P4 (Sep 22nd).

Note: attention to the following

CSCwd45843 Auth Step latency for policy evaluation due to Garbage Collection activity., solved in 3.1 P5.
CSCwc74531 ise hourly cron should cleanup the cached buffers instead of the 95% memory usage, solved in 3.1 P5

Hope this helps !!!

Re: ISE 2.7 upgrade to version 3 patch 4

Arne Bier — Mon, 10 Apr 2023 23:25:53 GMT

My own personal experience with 3.1p5 was that Cisco Phones whose EAP-TLS certificate was signed by Call Manager (CAPF cert) would fail - ISE was complaining about failed SSL decoding. We had to revert back to patch4 and then the phones started working again.

We have not tried patch 6

Re: ISE 2.7 upgrade to version 3 patch 4

Damien Miller — Mon, 10 Apr 2023 23:39:16 GMT

I would recommend two things for you.

Install 2.7 patch 9 prior to upgrading, this will limit the amount of change you experience going to 3.1 since many of the fixes in 2.7p9 are also built in to the 3.1 patches.
Target 3.1 patch 6 as your post upgrade release. Patch 6 includes an additional 87 publicly acknowledged bug fixes and a few that are quite severe in p5 hit. It also provides for the workaround with TPM stored certs on windows machines.