topic Re: ESXi requirement to run ISE version 3.2? in Network Access Control

ESXi requirement to run ISE version 3.2?

adamscottmaster2013 — Fri, 12 May 2023 10:29:01 GMT

According to Cisco documentation, in order to run ISE version 3.2: https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/install_guide/b_ise_installationGuide32/b_ise_InstallationGuide32_chapter_2.html. It stated:

VMware Virtual Hardware Version/Hypervisor
OVA templates: VMware version 14 or higher on ESXi 6.7 and later, and ESXi 7.x.
ISO file supports ESXi 6.5 or later.

When I attempted to upgrade ISE version 3.0 (which run on ESXi 6.7) to ISE version 3.2, I get this:

application upgrade proceed
Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
Upgrade tomcat backup complete.
-Checking VM for minimum hardware requirements
Required ESX Version 7.0 available to proceed with upgrade
sha256sum: /storeddata/Installing/.upgrade/bundle.tar: No such file or directory
STEP 1: Stopping ISE application...
STEP 2: Verifying files in bundle...

Is this a bug or just poor documentation?

Re: ESXi requirement to run ISE version 3.2?

Arne Bier — Sun, 14 May 2023 20:27:17 GMT

Ouch. Yeah probably documentation error. I have not touched 6.x for a while so I never ran into that.

The sentiment these days seems to be to contact the document writers via the feedback on the web page - maybe give that a go.

Re: ESXi requirement to run ISE version 3.2?

hslai — Mon, 22 May 2023 00:35:09 GMT

@adamscottmaster2013 What is the full name of the upgrade bundle file?

I checked ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542a.SPA.x86_64.tar.gz and that allows ESXi 6.5.

Re: ESXi requirement to run ISE version 3.2?

adamscottmaster2013 — Mon, 22 May 2023 11:57:12 GMT

I use ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542b.SPA.x86_64.tar.gz.

Apparently, the message during the upgrade said otherwise 😞

Re: ESXi requirement to run ISE version 3.2?

adamscottmaster2013 — Wed, 07 Jun 2023 12:31:51 GMT

Just tested again with upgrading from ISE 3.1 (running ESXi 6.7) to ISE 3.2 and got this message:

application upgrade ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542b.SPA.x86_64.tar.gz sFTP

Be sure that all your software is working stable, check your system on UI page (Administration > System > Health Checks)
Type yes once confirmed that health of the system is good to proceed: (yes/no) [yes] ? yes
Save the current ADE-OS running configuration? (yes/no) [yes] ? no

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
Verified OK
Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
Upgrade tomcat backup complete.
-Checking VM for minimum hardware requirements
Required ESX Version 7.0 available to proceed with upgrade
STEP 1: Stopping ISE application...

Either this is totally false or it is a much bigger issue.

Re: ESXi requirement to run ISE version 3.2?

ajc — Mon, 15 Jan 2024 20:47:57 GMT

Hi Adam,

We are proceeding soon to upgrade ISE 2.7 into ISE 3.2 and I have multiple VM's with ESXi 6.7 licenses (not 7) so I am wondering how you solved this issue. (P.D: I had another VM's running ESXi 7, restored a 2.7 config backup and upgraded them to 3.2 with no issues)

thanks

Re: ESXi requirement to run ISE version 3.2?

Arne Bier — Mon, 15 Jan 2024 21:01:43 GMT

I am 99.9999% sure that ISE doesn’t care (or check) what version of ESXi you have as long as you present the correct number of CPUs, RAM and disk to the underlying Linux OS. ESXi 6.7 is fine as far as the virtual hardware goes to support the boot up.

Re: ESXi requirement to run ISE version 3.2?

ajc — Thu, 18 Jan 2024 15:28:15 GMT

UPDATE: (I edited my previous post because I missed one final step)

I just confirmed in the lab, an ISE VM created in the UCS ESXi 6.7 Server can be upgraded with no issues. I only installed patch 10 on that VM running ISE 2.7 before the upgrade. See next:

ISE/admin# application upgrade ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542b.SPA.x86_64.tar.gz localdisk

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
Upgrade tomcat backup complete.
-Checking VM for minimum hardware requirements
Required ESX Version 6.7 available to proceed with upgrade
STEP 1: Stopping ISE application...
STEP 2: Verifying files in bundle...
-Internal hash verification passed for bundle
STEP 3: Validating data before upgrade...
STEP 4: Taking backup of the configuration data...
Truncating sec_txnlog_master - STANDALONE...
STEP 5: Running ISE configuration database schema upgrade...
- Running db sanity to check and fix if any index corruption
- Auto Upgrading Schema for UPS Model
- Upgrading Schema completed for UPS Model
ISE database schema upgrade completed.
STEP 6: Running ISE configuration data upgrade...
- Data upgrade step 1/68, NSFUpgradeService(2.8.0.127)... Done in 16 seconds.
- Data upgrade step 2/68, NetworkAccessUpgrade(3.0.0.10)... Done in 0 seconds.
- Data upgrade step 3/68, UPSUpgradeHandler(3.0.0.10)... Done in 2 seconds.
- Data upgrade step 4/68, GMTConfigRegistration(3.0.0.221)... Done in 0 seconds.
- Data upgrade step 5/68, UPSUpgradeHandler(3.0.0.227)... Done in 0 seconds.
- Data upgrade step 6/68, ERSDictionaryRegistration(3.0.0.240)... Done in 0 seconds.
- Data upgrade step 7/68, CertDictAttribAddition(3.0.0.240)... Done in 0 seconds.
- Data upgrade step 8/68, UPSUpgradeHandler(3.0.0.250)... Done in 33 seconds.
- Data upgrade step 9/68, EPScriptOSConfigRegistration(3.0.0.307)... Done in 0 seconds.
- Data upgrade step 10/68, AuthzUpgradeService(3.0.0.320)... Done in 0 seconds.
- Data upgrade step 11/68, RegisterPostureTypes(3.0.0.325)... Done in 0 seconds.
- Data upgrade step 12/68, ESAgentlessPostureScriptRegistration(3.0.0.352)... Done in 0 seconds.
- Data upgrade step 13/68, GuestAccessUpgradeService(3.0.0.355)... Done in 10 seconds.
- Data upgrade step 14/68, UpnDictionaryCreation(3.0.0.368)... Done in 0 seconds.
- Data upgrade step 15/68, UpnProfileCreation(3.0.0.368)... Done in 0 seconds.
- Data upgrade step 16/68, SessionServiceAgentlessRegistration(3.0.0.375)... Done in 0 seconds.
- Data upgrade step 17/68, PostureSettingsAgentlessRegistration(3.0.0.382)... Done in 0 seconds.
- Data upgrade step 18/68, SxpConnectionUpgrade(3.0.0.382)... Done in 0 seconds.
- Data upgrade step 19/68, RestIDStoreSettingsRegistration(3.0.0.385)... Done in 0 seconds.
- Data upgrade step 20/68, AnyNadProfIdRegistration(3.0.0.388)... Done in 0 seconds.
- Data upgrade step 21/68, AuthProfileUpgradeService(3.0.0.389)... Done in 0 seconds.
- Data upgrade step 22/68, AccessSecretEncryptionUpgrade(3.0.0.436)... Done in 0 seconds.
- Data upgrade step 23/68, ProvisioningRegistration(3.0.0.441)... Done in 7 seconds.
- Data upgrade step 24/68, UPSUpgradeHandler(3.0.0.442)... Done in 2 seconds.
- Data upgrade step 25/68, RuleResultsSGTUpgradeService(3.0.0.450)... Done in 0 seconds.
- Data upgrade step 26/68, SGTToTableMapper(3.0.0.450)... Done in 0 seconds.
- Data upgrade step 27/68, OpenApiRegistration(3.1.0.120)... Done in 1 seconds.
- Data upgrade step 28/68, CertMgmtUpgradeService(3.1.0.152)... Done in 2 seconds.
- Data upgrade step 29/68, RegisterPostureTypes(3.1.0.160)... Done in 39 seconds.
- Data upgrade step 30/68, NetworkAccessUpgrade(3.1.0.231)... Done in 0 seconds.
- Data upgrade step 31/68, EADictionaryCreation(3.1.0.238)... Done in 0 seconds.
- Data upgrade step 32/68, RegisterPostureTypes(3.1.0.247)... Done in 0 seconds.
- Data upgrade step 33/68, SGTUPSParityFixer(3.1.0.249)... Done in 0 seconds.
- Data upgrade step 34/68, SgVnVlanUpgradeService(3.1.0.250)... Done in 0 seconds.
- Data upgrade step 35/68, SgaclUpgradeService(3.1.0.250)... Done in 2 seconds.
- Data upgrade step 36/68, AuthProfileUpgradeService(3.1.0.262)... Done in 1 seconds.
- Data upgrade step 37/68, GuestAccessUpgradeService(3.1.0.273)... Done in 1 seconds.
- Data upgrade step 38/68, DictionaryUpgradeRegistration(3.1.0.293)... Done in 32 seconds.
- Data upgrade step 39/68, RegisterPostureTypes(3.1.0.333)... Done in 0 seconds.
- Data upgrade step 40/68, NetworkAccessUpgrade(3.1.0.334)... Done in 0 seconds.
- Data upgrade step 41/68, ProfilerUpgradeService(3.1.0.337)... Done in 0 seconds.
- Data upgrade step 42/68, PostureSettings8905PortRegistration(3.1.0.374)... Done in 0 seconds.
- Data upgrade step 43/68, CertMgmtUpgradeService(3.1.0.379)... Done in 1 seconds.
- Data upgrade step 44/68, UPSUpgradeHandler(3.1.0.398)... Done in 3 seconds.
- Data upgrade step 45/68, GuestAccessUpgradeService(3.1.0.431)... Done in 0 seconds.
- Data upgrade step 46/68, NSFIdentityProviderConfigUpgradeService(3.1.0.449)... Done in 0 seconds.
- Data upgrade step 47/68, GuestAccessUpgradeService(3.1.0.451)... Done in 1 seconds.
- Data upgrade step 48/68, TelemetryUpgrade(3.1.0.477)... Done in 0 seconds.
- Data upgrade step 49/68, CertMgmtUpgradeService(3.1.0.490)... Done in 0 seconds.
- Data upgrade step 50/68, RegisterPostureTypes(3.1.0.491)... ......Done in 381 seconds.
- Data upgrade step 51/68, ProvisioningRegistrationNew(3.2.0.0)... Done in 0 seconds.
- Data upgrade step 52/68, NetworkAccessUpgrade(3.2.0.100)... Done in 1 seconds.
- Data upgrade step 53/68, PassiveIdAttributeRegistration(3.2.0.225)... Done in 0 seconds.
- Data upgrade step 54/68, RegisterPostureTypes(3.2.0.250)... Done in 0 seconds.
- Data upgrade step 55/68, FiveGUpgradeService(3.2.0.256)... Done in 4 seconds.
- Data upgrade step 56/68, EADictionaryCreation(3.2.0.300)... Done in 0 seconds.
- Data upgrade step 57/68, CdaRegistration(3.2.0.302)... Done in 0 seconds.
- Data upgrade step 58/68, GeneralMdmSettingsRegistration(3.2.0.308)... Done in 0 seconds.
- Data upgrade step 59/68, TelemetryUpgrade(3.2.0.311)... Done in 0 seconds.
- Data upgrade step 60/68, NSFUpgradeService(3.2.0.312)... Done in 7 seconds.
- Data upgrade step 61/68, GuestAccessUpgradeService(3.2.0.339)... Done in 0 seconds.
- Data upgrade step 62/68, RestIDStoreRegistration(3.2.0.464)... Done in 0 seconds.
- Data upgrade step 63/68, UPSUpgradeHandler(3.2.0.468)... Done in 2 seconds.
- Data upgrade step 64/68, NSFUpgradeService(3.2.0.542)... Done in 0 seconds.
- Data upgrade step 65/68, ProfilerUpgradeService(3.2.0.542)... Done in 0 seconds.
- Data upgrade step 66/68, GuestAccessUpgradeService(3.2.0.542)... Done in 8 seconds.
- Data upgrade step 67/68, UPSUpgradeHandler(3.2.0.542)... Done in 0 seconds.
- Data upgrade step 68/68, ESUpgradeService(3.2.0.542)... ...........Done in 692 seconds.
STEP 7: Running ISE configuration data upgrade for node specific data...
STEP 8: Running ISE M&T database upgrade...
M&T Log Processor is not running
ISE database M&T schema upgrade completed.
% Warning: Some warnings encountered during MNT sanity check
Deleting stale upgradedb property files , if any.
% NOTICE: The appliance will reboot twice to upgrade software and ADE-OS. During this time progress of the upgrade is visible on console. It could take up to 30 minutes for this to complete.
Rebooting to do Identity Service Engine upgrade...

AFTER THE UPGRADE IS COMPLETED, Based on the following instruction you must change RHEL 7 to RHEL 8. That implies application stop ise + halt via CLI, then change the settings in the VM and finally power on the VM. See next

Cisco Identity Services Engine Upgrade Guide, Release 3.2

Re: ESXi requirement to run ISE version 3.2?

marinogr — Thu, 18 Jan 2024 04:32:30 GMT

I have upgraded from 3.1 to 3.2 in production enviroment with ESX 6.0 Compatibility.
In logs "Required ESX Version 7.0 available to proceed with upgrade

Only thing that it was increased was vCPU from 8 to 12.

Guest OS:Red Hat Enterprise Linux 8 (64-bit)
Compatibility:ESXi 6.0 and later (VM version 11)

Re: ESXi requirement to run ISE version 3.2?

Arne Bier — Thu, 18 Jan 2024 04:46:20 GMT

Not sure what you mean by "... with ESX 6.0 Compatibility."

Is the ESXi version 6.0 ? would hope not.

I tend to right-click on the VM and upgrade its compatibility to the latest version that the ESXi supports.

Re: ESXi requirement to run ISE version 3.2?

marinogr — Thu, 18 Jan 2024 04:55:55 GMT

It's ESX Version:7.0.3 with ISE Compatibility:ESXi 6.0. That's ISE check.

For VM and upgrade its compatibility it require a shutdown that's the problem on production enviroment :).