topic Re: ISE - Running URT on a primary pan, is it safe? in Network Access Control

ISE - Running URT on a primary pan, is it safe?

moha99edhamedan — Mon, 17 Jul 2023 23:03:51 GMT

im preparing to upgrade our single ISE node from v3.0 to 3.2

ive come across the URT tool but theres a couple of warnings in the guide and id like to confirm if its safe to run this tool

The warnings are
Do not run the URT on the Primary Policy Administration Node. The URT tool does not simulate MnT operational data upgrades.
In multiple-node deployments, do not run the URT on the Primary Policy Administration Node

Our current deployment have Primary Administration node (PAN) and Two Policy Service node (PSN)
can anybody advise if i can run URT on our Primary PAN even i don't have Secondary PAN

Regards

Re: ISE - Running URT on a primary pan, is it safe?

agrissimanis — Tue, 18 Jul 2023 19:36:22 GMT

This won't work, the URT tool can only be run on a secondary admin node or a standalone node.

You will be able to initiate the install of the tool but it will fail on the pre-checks

Your setup isn't really a recommended design, you should look at having two admin/monitoring nodes.

Re: ISE - Running URT on a primary pan, is it safe?

ahollifield — Tue, 18 Jul 2023 23:26:30 GMT

Your deployment is not a supported design. You need to migrate to one of the deployment types mentioned here: https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

You should do this before attempting any upgrade. This will be the first thing TAC calls out if you have any issues during the upgrade.