topic Re: ISE Deployment patching in Network Access Control

ISE Deployment patching

N3om — Thu, 28 Aug 2025 12:53:58 GMT

Six node distributed ISE Deployment

Whats the recommended order to patch fronm cli please.??

1.PRI-PAN which is also SEC MNT

2.SEC-PAN which is also PRI MNT

3.PSNs

Re: ISE Deployment patching

Arne Bier — Thu, 28 Aug 2025 21:32:32 GMT

Always Primary PAN first. Then the next PAN, PSNs last. I can't remember seeing a documented technical reason why this order is good/necessary. I think it's possibly just common sense because the primary database is on the Primary Admin node and since it's in charge of writing to the database, it gets patched first. The operational benefit of doing PAN first, is that you "take the hit" of taking down the admin GUI first, and then you can monitor the rest of the patching process from the GUI.

Re: ISE Deployment patching

balaji.bandi — Fri, 29 Aug 2025 06:35:12 GMT

check some guidance :

https://www.youtube.com/watch?v=qV5-KY0CCQo&t=177s

Post :

https://community.cisco.com/t5/network-access-control/patch-upgrade-in-cisco-ise-distributed-deployment/m-p/5287196

Re: ISE Deployment patching

adamscottmaster2013 — Sat, 30 Aug 2025 10:19:19 GMT

@Arne Bier wrote:
Always Primary PAN first. Then the next PAN, PSNs last. I can't remember seeing a documented technical reason why this order is good/necessary. I think it's possibly just common sense because the primary database is on the Primary Admin node and since it's in charge of writing to the database, it gets patched first. The operational benefit of doing PAN first, is that you "take the hit" of taking down the admin GUI first, and then you can monitor the rest of the patching process from the GUI.

Hi @Arne Bier: The poster asked about patching via the CLI. I just did one recently, and according to Cisco TAC, it should be in this order:

1- PAN

2- PSNs

3- SAN

Re: ISE Deployment patching

Arne Bier — Sat, 30 Aug 2025 11:30:01 GMT

At least we agree on PPAN first. I think the order I described is the same as what ISE developers chose when you patch via the GUI. I think that TAC has a more efficient method because you can test the patch on PSN a bit sooner. But apart from that it’s horses for courses.