topic Re: ACS 5.7 to ISE 3.x in Azure Upgrade in Network Access Control

ACS 5.7 to ISE 3.x in Azure Upgrade

simah78 — Thu, 09 May 2024 14:54:38 GMT

Hi All,

I am currently tyring to updage ACS 5.7 with patch4 to ISE 3.X and the traget location for ISE 3.X is Azure Cloud. Have not seen any upgrade guides and things to consider to perform this upgrade.So if someone who has done this can shed some light to this process that would be a great help.

Thanks,

Simah.

Re: ACS 5.7 to ISE 3.x in Azure Upgrade

balaji.bandi — Thu, 09 May 2024 15:56:31 GMT

There are some tools used long back ACS to ISE 2.X version, but sure ISE 3.0 changed lot now

check some guide help you :

https://www.youtube.com/watch?v=YFobxmbeC-8

Re: ACS 5.7 to ISE 3.x in Azure Upgrade

Greg Gibbs — Thu, 09 May 2024 23:01:33 GMT

ACS is long past the end of support. I believe the last ACS Migration Tool supported migration to 3.0, but I don't believe that tool is even available publicly any longer. You would also have to upgrade from your current version to 5.8 patch 4, perform the migration, then update from ISE 3.0 to 3.2 for native Azure support. You would have to do all of that on-prem, then backup the configuration and restore it to a 3.2 instance in Azure.

You would be much better off starting from scratch with ISE 3.2 in Azure and rebuilding your policies based on current business/technical requirements.

Re: ACS 5.7 to ISE 3.x in Azure Upgrade

Marvin Rhoads — Fri, 10 May 2024 02:44:58 GMT

Same answer I gave in the Partner Security discussion space.

https://community.cisco.com/t5/security-discussions/upgrade-acs-5-7-to-ise-3-x-in-azure/m-p/5096510#M4941

Please don't make duplicate posts.

Re: ACS 5.7 to ISE 3.x in Azure Upgrade

balaji.bandi — Fri, 10 May 2024 06:13:11 GMT

@Marvin Rhoads is there any public available that information, some how not able view that document suggested.

Re: ACS 5.7 to ISE 3.x in Azure Upgrade

Marvin Rhoads — Fri, 10 May 2024 11:10:28 GMT

@balaji.bandi here is the answer I posted in the Partner space (more or less what @Greg Gibbs said):

Yes, the tool is still there for ISE 3.0 which is almost at end of software maintenance.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-0.html

ISE running natively in Azure cloud was only introduced in ISE 3.2. https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/release_notes/b_ise_32_RN.html#concept_ich_dws_h5b

Theoretically you could build a temporary server on premises with ISE 3.0, migrate your ACS configuration to it, create a backup there and then restore that into ISE 3.2+ in Azure.

I'd still suggest the path of rebuilding from scratch since that ACS server must not have had much attention having gone so long past end of life without being migrated already.