topic Re: Cisco ISE Patch Process Question in Network Access Control

Cisco ISE Patch Process Question

ryanbess — Wed, 27 Mar 2024 12:54:41 GMT

We have a 4 node environment. My question is when you upload a patch to the Primary PAN and after then Primary PAN is finished Patching, how does the patch get then moved to the Secondary PAN and then the PSN? Does the Primary PAN push the file into the Secondary PAN's local repo, does the secondary PAN pull it, and in either scenario, what credentials are used?

Re: Cisco ISE Patch Process Question

ahollifield — Wed, 27 Mar 2024 12:58:17 GMT

Yes, the Primary Admin node manages the install process on all of the other nodes. However, I highly recommend using the CLI to patch instead as it gives you much more detailed output as the patch is progressing. You can also control the exact order and exactly when you want to patch each node. Start with the Primary Admin Node, after that the order doesn't matter.

Re: Cisco ISE Patch Process Question

Rob Ingram — Wed, 27 Mar 2024 12:58:38 GMT

Hi @ryanbess when you install the patch from the GUI, the patch is automatically installed on the Primary PAN first. The patch is then installed on the other nodes in the deployment in the order listed in the GUI, no credentials are required for the other nodes, ISE takes care of this.

Re: Cisco ISE Patch Process Question

ryanbess — Wed, 27 Mar 2024 13:00:30 GMT

How would a secondary PAN get the file off the Primary PANs local repository...there has to be some level of credential

Re: Cisco ISE Patch Process Question

Rob Ingram — Wed, 27 Mar 2024 13:03:54 GMT

@ryanbess if you use the GUI method you don't use the repo, you upload the file to the PAN and this is distributed amongst the other nodes.

Re: Cisco ISE Patch Process Question

ahollifield — Wed, 27 Mar 2024 13:12:46 GMT

No it’s pulled through the existing command/replication channel between the PAN and the other nodes.

Re: Cisco ISE Patch Process Question

ryanbess — Wed, 27 Mar 2024 13:13:24 GMT

right my question is around how it gets distributed amongst the other nodes. Are there any credentials involved, is it over SSH or the ERS API etc.

Re: Cisco ISE Patch Process Question

ryanbess — Wed, 27 Mar 2024 13:23:51 GMT

https://youtu.be/vUIlS8ko3CI?si=lbSw8I7ieTs53b2f this was also helpful thanks everyone