topic Re: Patching ISE? UI or CLI? in Network Access Control

Patching ISE? UI or CLI?

adamscottmaster2013 — Thu, 04 Jan 2024 12:43:42 GMT

I have a 4 nodes ISE 3.2 patch-4 cluster:
node1: Primary Admin/Primary MNT
node2: Secondary Admin/Secondary MNT
node3: PSN
node4: PSN

what is the best way to patch these nodes going forward to patch-5 and beyond? I am getting
different answers from Cisco TAC. One TAC engineer recommenend that I use the UI in node1 to
do the patching and another engineer recommended the CLI:

- patch node1 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node3 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node4 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node2 via CLI, wait for the node to be rebooted and back into the cluster,

I've seen in multiple situations that using the UI is NOT very reliable because after node1
got patched, node2...node4 did not get patched.

What is the best and support way to patch my ISE cluster? Also is the CLI sequence of patching correct?

TIA

Re: Patching ISE? UI or CLI?

ahollifield — Thu, 04 Jan 2024 13:38:30 GMT

CLI, much easier to monitor/control. The CLI gives you progress output that the GUI does not.

Re: Patching ISE? UI or CLI?

adamscottmaster2013 — Thu, 04 Jan 2024 15:20:27 GMT

In my scenario, what would be the correct sequence?

Re: Patching ISE? UI or CLI?

ahollifield — Thu, 04 Jan 2024 16:03:50 GMT

Start with Primary Admin Node. After that the order doesn't matter, whatever is best for your individual deployment's HA strategy

Re: Patching ISE? UI or CLI?

PSM — Thu, 04 Jan 2024 17:34:59 GMT

Agree to @ahollifield CLI gives better control. Although initiating from GUI is easiest, but you don't have such monitor and control.