topic Re: Hardware Migration from 36xx to 37xx in Network Access Control

Hardware Migration from 36xx to 37xx

santhoshkdhanapal — Mon, 12 Aug 2024 06:38:06 GMT

Hi All,

Kindly suggest the prequiste to be considered when migrating ISE hardware from 36xx to 37xx and current ISE version is 3.0 . Which version is the stable version ? I worked in ISE 3.2 but with TAC cases ,they recommend so many patch to update. Please share any documents or your previous experience with respect to migration of ISE hardware and backup restore. I appreciate in advance.

Cheers,

Santhosh

Re: Hardware Migration from 36xx to 37xx

Mark Elsen — Mon, 12 Aug 2024 08:51:21 GMT

>...Which version is the stable version ?
https://software.cisco.com/download/home/283801620/type/283802505/release/3.3%20Patch%202
Is currently recommended version ; note that link is only summary you must first install and or upgrade to 'full'
3.3 and then install patch2.

Note that your question consists of two parts, upgrading and moving to new hardware , for upgrading
consult : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/Cisco_ISE_3-3_Upgrade_Journey.html
(edited/added) : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf)

For the new hardware : possibly a configuration backup and restore on that can be done from your current ISE
version ; check the previous document (link) mentioned for info's on that.
My advices : take the whole project out of a production environment and test first when finished (e.g.)
Consider building it from scratch and configuring the policies manually
Test before 'returning' the new hardware device(s) to production!

(edited2/added) : Appendix : https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2889.pdf
(edited3/added) https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/release_notes/b_ise_33_RN.html

Also note from the above : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/release_notes/b_ise_33_RN.html#concept_vlf_w5f_rsb

Re: Hardware Migration from 36xx to 37xx

santhoshkdhanapal — Mon, 12 Aug 2024 11:01:50 GMT

Hi @Mark Elsen ,

Thanks for the response. In new hardware ie 37xx we restore the configuration backup. what's the status of old hardware when i do migration ? Do i keep both hardware appliance up in production or how does it work ? And the certificates backup need to be restored separately , is it correct and how about license?

Re: Hardware Migration from 36xx to 37xx

Mark Elsen — Mon, 12 Aug 2024 11:08:43 GMT

>.... In new hardware ie 37xx we restore the configuration backup.
- First , it's better to have ise 3.3 with patch2 installed first and then restore a configuration backup from the 3.0 environment
to have an easy work flow

>...Do i keep both hardware appliance up in production or how does it work ?
- In whatever topology concerning management and policy server nodes (PAN,PSN,MNT) , you can't have mixed versions.