topic ISE Nodes in Azure in Network Access Control

ISE Nodes in Azure

InfraISE2020 — Mon, 12 Jun 2023 10:39:48 GMT

Hi all,

We currently run our ISE nodes on virtual hardware on premise and are now looking to shift our infrastructure to the cloud.

I know its possible to deploy ISE nodes in Azure but i seem to recall documentation that suggests the ISE nodes cannot be upgraded like you can on premise, is that still the case?

If we wanted to deploy a patch or upgrade to a later ISE version, can this be done natively on the nodes or do they need replacing each time we upgrade?

FYI the latency for AAA should not be an issue as we have express route to Azure.

Re: ISE Nodes in Azure

Mark Elsen — Mon, 12 Jun 2023 11:30:25 GMT

- Ref : https://www.cisco.com/c/en/us/td/docs/security/ise/ISE_on_Cloud/b_ISEonCloud/m_ISEonAzureServices.html#concept_gd4_rzr_tsb
>...The Cisco ISE upgrade workflow is not available in Cisco ISE on Microsoft Azure. Only fresh installs are supported. However, you can carry out backup and restore of configuration data. For information on upgrading hybrid Cisco ISE deployments, see Upgrade Guidelines for Hybrid Deployments.

Re: ISE Nodes in Azure

thomas — Mon, 12 Jun 2023 13:36:00 GMT

Patches may be done on the cloud nodes.

Re: ISE Nodes in Azure

InfraISE2020 — Mon, 12 Jun 2023 13:42:24 GMT

Thanks @thomas . Just to clarify, if we was in the cloud and was running say 3.1 patch 3 we could upgrade to 3.1 patch 7 for example but if a new version of ISE was released, say v4, in order for us to move to that version we would need to deploy new ISE nodes on v4 and do a backup and restore of the configuration and operational data?

Re: ISE Nodes in Azure

thomas — Mon, 12 Jun 2023 19:22:21 GMT

Correct.