topic Re: Patching ISE in multi-node deployment, Cisco official recommendati in Network Access Control

Patching ISE in multi-node deployment, Cisco official recommendation

rezaalikhani — Tue, 27 Jun 2023 18:19:28 GMT

Hi all;

I searched google and several documents and resources from Cisco and other experts regarding to find best practices for patching ISE in multi-node deployment. None of them had exact same procedures. Can anyone in Cisco officially state the supported scenario with minimal disruption in mind?

Thanks

Re: Patching ISE in multi-node deployment, Cisco official recommendati

Aref Alsouqi — Tue, 27 Jun 2023 20:20:47 GMT

There are two options, option one is via ISE GUI, this will apply the patch on all nodes one at a time. Option two is via CLI which I personally prefer because it gives more control as you can decide which node you want to patch first. Unlike upgrading ISE which has to be done in a specific order, applying the patch can be in any order.

Re: Patching ISE in multi-node deployment, Cisco official recommendati

rezaalikhani — Wed, 28 Jun 2023 05:14:39 GMT

Thanks for your reply. You mentioned that when we use the GUI method, the patching operation takes place one server at a time. This is my confusing situation! In which order?

Re: Patching ISE in multi-node deployment, Cisco official recommendati

Aref Alsouqi — Wed, 28 Jun 2023 08:31:40 GMT

It will start with the primary PAN and then if that is successful it will carry on installing the patch on the nodes in the order you see in the deployment page in the GUI. If any of the other nodes should fail installing the patch, it will still carry on with the next one. So essentially it will only stop if the installation on the primary PAN should fail.

Re: Patching ISE in multi-node deployment, Cisco official recommendati

rezaalikhani — Wed, 28 Jun 2023 16:08:04 GMT

So, after the patch is successfully installed on the PAN, it is applied to all nodes in the cube one at a time, in alphabetical order. Right?

Searching on Google, we can find documents that believe applying ISE patches have orders beyond alphabetical order. For example:

What to you think?

Thanks

Re: Patching ISE in multi-node deployment, Cisco official recommendati

Aref Alsouqi — Wed, 28 Jun 2023 19:47:45 GMT

I found this:

"If you are installing the patch from the GUI, the patch is automatically installed on the Primary PAN first. The system then installs the patch on the other nodes in the deployment in the order listed in the GUI. You cannot control the order in which the nodes are updated.".

Cisco ISE 3.1 Upgrade Guide: Install Latest Patch - Cisco

Re: Patching ISE in multi-node deployment, Cisco official recommendati

rezaalikhani — Thu, 29 Jun 2023 15:12:41 GMT

Thanks for your following up...