topic Re: ISE cluster upgrade in Network Access Control

ISE cluster upgrade

manvik — Wed, 29 May 2024 12:59:38 GMT

ISE nodes in DC and DR plus a monitoring node. DC & DR node runs admin, policy service in single node. Currently version 3.2, what's the procedure to upgrade to 3.3 in this scenario.
Should we upgrade node one-by-one.

Re: ISE cluster upgrade

Ben Walters — Wed, 29 May 2024 16:02:16 GMT

There are a number of steps required for an ISE upgrade and it really depends on your node setup.

If you have a look at this guide: https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf

Starting on page 21 it will go over the process and it has the upgrade order for all different types of deployment, just choose the one that matches your setup and follow that.

Re: ISE cluster upgrade

ahollifield — Wed, 29 May 2024 16:59:45 GMT

What type of deployment is this? Small medium or large? It sounds to me like this is not supported deployment. What roles are on each node? How many nodes?

Re: ISE cluster upgrade

Marcelo Morais — Wed, 29 May 2024 20:48:23 GMT

Hi @manvik ,

1st to get the software: ISE Software Download.

2nd check your ISE 3.2 Patch number ... remember that ISE 3.3 has parity with ISE 3.2 Patch 2.

3rd you will upgrade your ISE Cluster first to ISE 3.3 and next to ISE 3.3 Patch 2 (the latest version of ISE 3.3)

4th use the URT (Upgrade Readiness Tool) to validate Config DB upgrade from 3.2 to 3.3 (file ise-urtbundle-3.3.0.430a-1.0.0.SPA.x86_64.tar.gz)

5th you can upgrade via CLI or GUI (check the Cisco ISE Journey for Release 3.3) and choose your upgrade sequence of the Nodes, please take a look at:

Hope this helps !!!

Re: ISE cluster upgrade

manvik — Mon, 03 Jun 2024 04:53:27 GMT

@ahollifield it's a small deployment. Each ISE VM has policy, admin node. ISE used only for Tacacs authentication. The tac says upgrade can be done from ISE 3.2 to 3.3.

Re: ISE cluster upgrade

manvik — Mon, 03 Jun 2024 07:06:32 GMT

Thank you @Marcelo Morais and @Ben Walters the TAC says upgrade can directly be done to version 3.3. I am planning to do so.
Most of the ISE upgrade documents were mentioning to detach ISE node from cluster before upgrade, then perform upgrade.
I understand it's not required. If upgrading OS first upgrade secondary ISE VM, then primary.
If upgrading patch first primary then secondary ISE VM.

Re: ISE cluster upgrade

ahollifield — Mon, 03 Jun 2024 12:12:35 GMT

Got it, so only two nodes then?

Re: ISE cluster upgrade

manvik — Mon, 03 Jun 2024 13:53:46 GMT

Yes, two nodes + one for dedicated monitoring (MnT).

Re: ISE cluster upgrade

ahollifield — Mon, 03 Jun 2024 14:00:18 GMT

Huh? This is not a supported deployment type. How many nodes total? Three?

https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Re: ISE cluster upgrade

Marcelo Morais — Mon, 03 Jun 2024 15:01:42 GMT

Hi @manvik ,

if you "detach" ISE Node (de-register the Secondary Node from Primary), your Small Deployment will become two Standalone Deployment., after that you are able to upgrade one Standalone Deployment to ISE 3.3 Patch 2 and double check if everything is fine before upgrade the other Standalone Deployment.

Hope this helps !!!