topic Re: ISE 3.3p3 restore fails - Upgrade in Network Access Control

ISE 3.3p3 restore fails - Upgrade

hevo — Tue, 08 Oct 2024 10:58:38 GMT

having already experienced various issues on the path to upgrade ISE from 3.2p6 to 3.3p3, we followed Cisco's rebuild and restore upgrade mandate for ISE on Public Clouds (https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/release_notes/b_ise_33_RN.html). However, restores are failing with backups containing actual setup (backup and restore from vanilla 3.3p3 standalone work). the restore just terminates and ise gets stuck in initialisation, even "debug backup-restore all" does not provide a more granular error:

[573331]:[error] backup-restore:backup: br_restore.c[1709] [system]: Error: Upgrading ISE database failed. Restore terminated.

Did anyone succeed with this or a similar upgrade? Appreciate any suggestions on resolution, while TAC is trying to recreate the problem....

Re: ISE 3.3p3 restore fails - Upgrade

Arne Bier — Tue, 08 Oct 2024 22:38:58 GMT

I assume from your posting that you're dealing with a public cloud ISE deployment.

Did you run the URT on the ISE 3.2p6 Standby PAN (if that's at all possible) ?

I have only done on-prem 3.2 to 3.3 upgrades (in place, as well as backup restore upgrades).

Re: ISE 3.3p3 restore fails - Upgrade

hevo — Tue, 15 Oct 2024 10:44:42 GMT

thank you for your post, you are correct, all our nodes run in a public cloud and yes we did run URT successfully on the secondary pan/mnt node before commencing. not sure why that matters though as we have to do a rebuild / restore? good to hear that the on prem upgrade works...

Re: ISE 3.3p3 restore fails - Upgrade

Arne Bier — Tue, 15 Oct 2024 20:51:35 GMT

There comes a point where you must engage Cisco TAC because only they can dig deeper into the root cause. What you're experiencing is not common and can be very hard to debug as a non-root user.