topic Re: ISE Small Deployment upgrade in Network Access Control

ISE Small Deployment upgrade

Chess Norris — Wed, 11 Oct 2023 07:35:47 GMT

Hello,

I'm planning for upgrading a Small Deployment ISE setup with just a primary and secondary node.

The upgrade will be from ISE 2.7 to 3.2.

After upgrading the secondary node, do I need to de-register the node from the cluster, or should I turn off failover and promote the secondary node to primary?

Also, what is the best way to deal with the license transfeer from the old 2.x licenses? Should I prepare to get the new licenses in my smart account before the upgrade or should I ask Cisco to migrate the licenses after the upgrade?

Thanks

/Chess

Re: ISE Small Deployment upgrade

Mark Elsen — Wed, 11 Oct 2023 08:04:19 GMT

- FYI : https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_2_pdf.pdf

Re: ISE Small Deployment upgrade

ahollifield — Wed, 11 Oct 2023 12:40:38 GMT

https://community.cisco.com/t5/security-knowledge-base/ise-version-upgrade-matrix/ta-p/3653501

Yes you should open a licensing TAC case to migrate your 2.X licenses to 3.X smart licenses.

Re: ISE Small Deployment upgrade

Chess Norris — Thu, 12 Oct 2023 06:49:27 GMT

Thanks for the reply.

I am a bit confused about the "application upgrade prepare" command. According to the upgrade guide, this command will copy the ISE image from the remote repo to the local repo I already created, but when I do a "show <local repo>, I just see some log files there, but no image.

Same if I do dir disk 😕

I saw an older upgrade instructions where it says

For upgrade, you can copy the upgrade bundle to the Cisco ISE node's local disk using the following command:
copy repository_url/path/ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz disk:/
For example, if you want to use SFTP to copy the upgrade bundle, you can do the following:

(Add the host key if it does not exist) crypto host_key add host mySftpserver
copy sftp://aaa.bbb.ccc.ddd/ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz disk:/
aaa.bbb.ccc.ddd is the IP address or hostname of the SFTP server and ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz is the name of the upgrade bundle."

Should I use the copy command or is the "application upgrade prepare" enough to copy the ISE upgrade bundle to the local repo?

Also how about patching? Should I promote the secondary node to primary after I patch it?

Thanks

/Chess

Re: ISE Small Deployment upgrade

ahollifield — Thu, 12 Oct 2023 13:22:26 GMT

The prepare is enough. In both scenarios the upgrade bundle is copied to the local machine. Don't forget to the run the URT on the secondary admin node.

Patching no, you patch the PAN first.

Re: ISE Small Deployment upgrade

Chess Norris — Fri, 13 Oct 2023 06:37:15 GMT

Thank you for the confirmation.

/Chess

Re: ISE Small Deployment upgrade

Zaaf Aba — Tue, 08 Apr 2025 13:49:27 GMT

After lot of troubleshooting the following worked. Remember to provide full file path.

radius-b/admin# copy sftp://10.10.10.9/home/user2/ise-urtbundle-3.2.0.542a-1.0.0.SPA.x86_64.tar.gz disk:/

it will ask for a username and password on Linux box