topic Re: ISE deployment - different versions for migration in Network Access Control

ISE deployment - different versions for migration

stephan.ochs — Mon, 23 Oct 2023 07:21:57 GMT

Next year we need to migrate our deployment (2 ISE 2.7 on SNS-3515) to new hardware and newest version.
My plan is to install new hardware, add it to the existing deployment and remove the old ones.

I was searching for some information about compatibility between ISE versions within a deployment, but didn't find anything.

I am nearly sure 2.7 won't be possible with 3.3.
The maximum version for SNS-3515 is 3.0.
So would it be possible to update our existing ISE deployment to 3.0, add new ISE with 3.3 and then remove the 3.0?

Re: ISE deployment - different versions for migration

Mark Elsen — Mon, 23 Oct 2023 07:57:25 GMT

- You may find this document useful : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf

Re: ISE deployment - different versions for migration

stephan.ochs — Mon, 23 Oct 2023 08:10:32 GMT

Yes, this document is useful for upgrading, but not for my question.
I can find upgrade paths here, but my essential question is:
Is it possible to have a deployment with "mixed" Versions: ISE 2.7 and ISE 3.3 or ISE 3.0 and ISE 3.3.

Re: ISE deployment - different versions for migration

Mark Elsen — Mon, 23 Oct 2023 08:22:43 GMT

- It isn't ,

Re: ISE deployment - different versions for migration

stephan.ochs — Mon, 23 Oct 2023 08:26:40 GMT

It isn't for 2.7/3.3?
For 3.0/3.3 it should be possible.
When upgrading a deployment from 3.0 to 3.3 (possible as written in upgrade guide) there's the situation, that I have some 3.0 and 3.3 mixed in the deployment.
Right?

Re: ISE deployment - different versions for migration

Marvin Rhoads — Mon, 23 Oct 2023 16:14:18 GMT

ALL nodes in a given ISE deployment must be the same major and minor release. This applies for all versions of ISE ever.

Patch versions can vary, but it's not recommended to run that way for an extended period - only during deployment of patches to the next level,

Re: ISE deployment - different versions for migration

Dustin Anderson — Mon, 23 Oct 2023 16:27:12 GMT

Best is to restore a backup to the new appliance on the new code. Test it with a demo VM to make sure, but we did this going for 3595s to 3765s 2-node deployments. We basically shut the primary down, brought the new one up on the new code/patch and restored the backup. Then did the secondary and joined it to the first in HA. We went from 2.6 to 3.1 this way without issues.

Re: ISE deployment - different versions for migration

stephan.ochs — Tue, 24 Oct 2023 06:11:45 GMT

Thank you for your help. I was hoping there was a way to do a soft migration. We will probably do it via backup/restore.