topic Re: Patch Upgrade in Cisco ISE Distributed deployment ? in Network Access Control

Patch Upgrade in Cisco ISE Distributed deployment ?

palani2010 — Fri, 02 May 2025 11:33:18 GMT

Patch Upgrade in Cisco ISE Distributed deployment ?

In Cisco ISE Distributed deployment, We have two PAN ( PAN Autofailover is not enabled), two MNT and 10 PSN and i want to upgrade Patch in my environment.

If i update it PAN, PAN will push secondary PAN, two MNT and other PSN automatically or else we have do it anything manually.

Note - PAN failover is not enabled.

Re: Patch Upgrade in Cisco ISE Distributed deployment ?

Mark Elsen — Fri, 02 May 2025 12:03:57 GMT

-Personally I prefer manually/using the CLI always because it gives more granual control and more error feedback, if any.

Re: Patch Upgrade in Cisco ISE Distributed deployment ?

Torbjørn — Fri, 02 May 2025 12:09:12 GMT

Yes, when you apply a patch it is applied to the whole deployment

Re: Patch Upgrade in Cisco ISE Distributed deployment ?

palani2010 — Fri, 02 May 2025 12:12:04 GMT

If PAN Failover is disabled. It should update without any issues.

Re: Patch Upgrade in Cisco ISE Distributed deployment ?

Marcelo Morais — Sat, 03 May 2025 06:59:23 GMT

Hi @palani2010 ,

please take a look at: Cisco Identity Services Engine Upgrade Journey, Release 3.4, click Install latest Patch of your current Release.

Note 1: in GUI you have: Full Upgrade (starts with PPAN and then all the other Nodes at once) or Split Upgrade (starts with SPAN and the other Nodes step by step), and in CLI, you need to install the Patch manually on each Node.

Note 2: the PAN auto-failover configuration must be disabled for the duration of the Upgrade/Update.

Hope this helps !!!