topic upgrade ISE in AWS in Network Access Control

upgrade ISE in AWS

bgoulet00 — Tue, 30 Jan 2024 20:37:16 GMT

knowing this is a replace rather than upgrade my plan to to build a whole new cluster in parallel and use backup/restore to migrate the configuration to the new cluster. the new cluster will have all different hostnames and IPs so how do the clients access the new system?

my thought is to create a cname that points to the old PSNs and configure all devices to point to the cname for radius and tacacs services. when it is time to migrate over to the new cluster just repoint the cnames. my concern is i don't know if the network devices perform dns caching which would keep them going to the old cluster until the cache ages out.

is this the best approach? is there a better way? i really need a way for the cutover to be seamless and we can't go reconfiguring devices to point to a new location every time we upgrade.

Re: upgrade ISE in AWS

Charlie Moreton — Tue, 30 Jan 2024 21:42:33 GMT

Certificates will break if using your method.

This is a perfect use-case for load balancers.

https://cs.co/ise-lb

Cloud Load Balancers with ISE

Re: upgrade ISE in AWS

Greg Gibbs — Tue, 30 Jan 2024 21:48:11 GMT

Not all network devices support DNS-based configuration for RADIUS servers. A better solution would be to put a load balancer in front of the PSNs and configure the network devices to use the VIPs for RADIUS servers. You can then update the server pools on the LB as the PSN IP addresses change.

You could also take the approach of replacing the nodes one at a time (or in a group, depending on the deployment) as you build the new cluster to use the same IP addresses without overlap. This would rely on the network devices finding the RADIUS servers dead and moving to the next available, so it's not as fluid as using a load balancer to do that systematically.

The approach would be something like:

Shutdown the Secondary PAN; rebuild as Primary PAN in new cluster
Backup/Restore config to new P-PAN
Shutdown the Secondary MnT; rebuild as Primary MnT in new cluster
Shutdown one or more PSNs and rebuild; join to new cluster
Shutdown the remaining PSNs and rebuild; join to new cluster
Shutdown the Primary PAN and MnT; rebuild as Secondaries in new cluster
Make the new Secondary PAN the active Primary PAN

Re: upgrade ISE in AWS

bgoulet00 — Wed, 31 Jan 2024 19:47:48 GMT

Thank you Charlie and Greg. i will pursue the load balancer option