topic Re: ISE Upgrade Query in Network Access Control

ISE Upgrade Query

benolyndav — Mon, 28 Oct 2024 18:29:13 GMT

i have downloaded the the 3.3 upgrade bundle to our ISE Nodes, When I select the Sec PAN to be upgraded its stating 480 mins is this accerate, We are upgrading from 3. to 3.3

Also I have ran the purge from the gui fro data older than 30 days, Also is it possible to upgrade using cli now I have used the gui to download the bundle to the nodes? If so would upgrade using cli method be quicker ?

Thanks

Re: ISE Upgrade Query

Rob Ingram — Mon, 28 Oct 2024 18:40:52 GMT

@benolyndav refer to the following Cisco guide - https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2889.pdf which provides a break down of the upgrade methods. CLI still takes a long time compared to the GUI upgrade, but is considered more complex and more work.

https://www.youtube.com/watch?v=D7poFnsd-8U&pp=ygULaXNlIHVwZ3JhZGU%3D

https://www.youtube.com/watch?v=q2JpC8oNssA&pp=ygULaXNlIHVwZ3JhZGU%3D

Re: ISE Upgrade Query

benolyndav — Mon, 28 Oct 2024 18:44:13 GMT

@Rob Ingram
Yes I have watced these and had forgot about the cli method being long, I am thinking the upgrade hasnt got a chance of being succesful due to the 4 hour upgrade process time limit, any thoughts please, is the 480 just an approx figure or is it accurate ?

Thanks

Re: ISE Upgrade Query

Rob Ingram — Mon, 28 Oct 2024 18:52:29 GMT

@benolyndav the last upgrade I performed (3.1 > 3.2) was quicker than the URT stated. How big is your database? What hardware are you using (physical or VM)?

What about using the Backup and Restore method?

Have you purged operational data, inactive endpoints and guest accounts?

Re: ISE Upgrade Query

benolyndav — Mon, 28 Oct 2024 19:14:28 GMT

@Rob Ingram

VMs for hardware

M&T primary =47GB

M&T standby =39GB
We have 30000 inactive endpoints, I cant find how to purge these any idea please.?

Thanks

Re: ISE Upgrade Query

Rob Ingram — Mon, 28 Oct 2024 19:27:06 GMT

@benolyndav navigate to Administration > Identity Management > Settings > Endpoint Purge and create/modify the purge rule.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_maintain_monitor.html#concept_0776B37A2C3542189950F5DFB1961FA2

You can purge the operational data as below.

Re: ISE Upgrade Query

benolyndav — Mon, 28 Oct 2024 19:37:20 GMT

@Rob Ingram

I have already ran this one, I will have a look at the endpoints purge

Re: ISE Upgrade Query

benolyndav — Tue, 29 Oct 2024 09:42:16 GMT

@Rob Ingram
In the maintenance tab what does( purge all data) do, I have purged data older than 20 days for now, Is it worth even attempting the upgrade if its stating estimate 480 mins for the PANS? could I expect the upgrades to be completed within the 4 hour threshold ??

Re: ISE Upgrade Query

Rob Ingram — Tue, 29 Oct 2024 16:55:10 GMT

@benolyndav

Operational Data Purging

Cisco ISE Monitoring Operational database contains information that is generated as Cisco ISE reports. Recent Cisco ISE (Cisco ISE Release 2.4 and above) releases have options to purge the monitoring operational data and reset the monitoring database when the application configure ise command is run.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_deployment.html#id_39776

This data can be purged as long as you don't not wish to run historical reports.

Can you re-run the URT after the data purge, what is the estimate now? The duration estimate is subject to environment specifics, 480 does seems excessive compared to the last upgrade I performed.

Re: ISE Upgrade Query

benolyndav — Tue, 29 Oct 2024 17:14:16 GMT

@Rob Ingram

Is it ok to run urt again now i have downloaded upgrade bundle to all nodes.?

Thanks

Re: ISE Upgrade Query

Rob Ingram — Tue, 29 Oct 2024 17:16:54 GMT

@benolyndav yes, ok to re-run the URT, just make sure no changes are being made nor backup taking place when the URT is run.

Re: ISE Upgrade Query

benolyndav — Tue, 29 Oct 2024 18:10:19 GMT

@Rob Ingram

actually just noticed that urt says 2 hours less than gui, still seems to be lot of MnT?

Time estimate for upgrade

=========================

(Estimates are calculated based on size of config and mnt data only. Network latency between PAN and other nodes is not considered in calculating estimates)

Estimated time for each node (in mins):

MNT data is 58 GB, purging this data can reduce upgrade time

MAD-ISE-01(SECONDARY PAP,MNT):365

MNT data is 58 GB, purging this data can reduce upgrade time

CAM-ISE-01(PRIMARY PAP,MNT):360

MNT data is 58 GB, purging this data can reduce upgrade time

Each PSN(5 if in parallel):65

mnt.analytics.storage already exists in platform.properties

mnt.analytics.storage already exists in platform.properties-active

Final cleanup before exiting...

Application successfully installed

Re: ISE Upgrade Query

Rob Ingram — Tue, 29 Oct 2024 18:42:52 GMT

@benolyndav either purge more data to reduce upgrade time or use the backup/restore method.

Re: ISE Upgrade Query

benolyndav — Wed, 30 Oct 2024 18:11:37 GMT

@Rob Ingram
Do I need a different version of putty to ssh onto 3.3 i input credentials then the window opens and instantly shuts ??

Re: ISE Upgrade Query

Rob Ingram — Wed, 30 Oct 2024 18:17:49 GMT

@benolyndav I cannot say I've had a problem, I use the latest version of putty (0.81) without issue. Can you connect to the VM console of the node and confirm it is actually up?

Re: ISE Upgrade Query

benolyndav — Wed, 30 Oct 2024 18:31:16 GMT

@Rob Ingram Yes its running and I can connect via gui, another thing I do not see an option for RHEL 8.4 in edit vm any ideas? its still on RHEL 7

Edit SSH is fine

Re: ISE Upgrade Query

Rob Ingram — Wed, 30 Oct 2024 18:31:11 GMT

@benolyndav not sure, check the service sshd settings - https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/cli_guide/b_ise_CLIReferenceGuide_26/b_ise_CLIReferenceGuide_26_chapter_011.html#wp1664237597

Have you applied the latest 3.3 patch yet post upgrade?

Isn't that related to Vmware then? What version of Vmware do you run?

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/install_guide/b_ise_installationGuide33/b_ise_InstallationGuide33_chapter_4.html

Re: ISE Upgrade Query

benolyndav — Wed, 30 Oct 2024 19:02:53 GMT

@Rob Ingram found it compatibilitymode in edit vm settings

Re: ISE Upgrade Query

Aref Alsouqi — Thu, 31 Oct 2024 14:58:18 GMT

I personally always try to upgrade using CLI as I find it more reliable and quicker since there are no dependencies on the web browsers. If you already uploaded the upgrade image to the local disk then you can still continue the upgrade via CLI. You just need to create a local repository on each node if you don't have one already, and point to the local repository when you issue the readiness tool and upgrade prepare commands.

Re: ISE Upgrade Query

wsteele@conres.com — Thu, 31 Oct 2024 16:51:30 GMT

If you have enough VM resources upgrading ISE using the Backup and Restore method always saves time and cuts down on risk without having to purge any data.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/upgrade_guide/HTML/b_upgrade_method_3_1.html#id_125062