topic ACS 4.2 to 4.2.1 Upgrade Questions in Network Access Control

ACS 4.2 to 4.2.1 Upgrade Questions

adil.nasser3 — Mon, 11 Mar 2019 03:56:19 GMT

I have been tasked to upgrade our four ACS servers from

4.2.1.15 to the latest version. The ACS servers are

applianced based. I have browsed the download software page

of cisco.com and have found this file:

app/Acs_4.2.1.15.11.zip (ACS SE 4.2.1.15.11 cumulative

patch).

Can someone confirm if this is the latest/best file to download

the latest 4.2 release of hardware based Cisco Secure ACS?

For those who have upgraded to this latest release, can you

comment on your experience regarding the upgrade process or

ACS performance post-upgrade? Any issues/caveats about the

process or performance post-upgrade?

Thanks in advance for any helpful information you can

provide for this?

Adil

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Thu, 26 Sep 2013 19:59:58 GMT

Hello Adil,

First thing I would like to clear that 4.2.1.15.11 is Just a patch and not an upgrade.

We introduced this patch for users who are using eap-fast and affeceted due to this vulnerability.

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130828-acs

However, with patch 9, 10 and 11 Csutil feature will break and for that we've already filed a defect

CSCuj39621 CSUtil crashes when no arguments are provided from ACS 4.2.1 patch 9

So you only need to apply patch 11 if

you have radius/acs server configured for eap-fast and you're not running csutil for your internal requirement.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

adil.nasser3 — Thu, 26 Sep 2013 20:42:28 GMT

Ok, I understand now that this is only a patch but can you please advise as to what the step-by-step procedure would be for applying the 11 patch. Would I use the same procedure as doing an upgrade? IE. Use the distribution server to transfer file to ACS appliance, log on to ACS and use System Configuration to verify the download, etc., etc.

I've never performed this procedure so any helpful details you can provide would be greatly appreciated.

Thanks,

Adil

Re: ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Thu, 26 Sep 2013 21:01:15 GMT

so yes the steps will remain same, make sure you stop csagent before you start and start csagent once you are done. You need to apply the same code patch on server running remote agent

Remote Agent 4.2.1.15.11 cumulative patch

Acs-4.2.1.15.11-RA.zip

http://tools.cisco.com/squish/127b7

I've attached the steps to install patch for your reference.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

Abha Jha — Thu, 26 Sep 2013 23:23:21 GMT

4.2.1.15 is the latest software for ACS for 4.2.

Upgrade process:-

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.

2/installation/guide/windows/install.html

Once upgraded from 4.2 to 4.2.1.15 , download the following files to upgrade to 4.2.1.15:

Upgrade Package for ACS SE v4.2.1.15 (Appliance Management package)

Upgrade Package for ACS SE v4.2.1.15 (ACS Software package)

Remote Agent for Windows for ACS SE v4.2.1.15

ACS SE 4.2.1.15.11 cumulative patch

Remote Agent 4.2.1.15.11 cumulative patch

http://software.cisco.com/download/release.html?mdfid=281458154&flowid=34566&softwareid=28

0805678&release=4.2.1.15&relind=AVAILABLE&rellifecycle=&reltype=latest

ACS 4.2 to 4.2.1 Upgrade Questions

Muhammad Munir — Fri, 27 Sep 2013 03:49:57 GMT

Hi Adil

ACS provides a migration utility to transfer data from migration-supported versions of ACS 4.x to any ACS 4.x machine. The ACS migration process requires, in some cases, administrative intervention to manually resolve data before you import it to ACS.

The Migration utility completes the data migration process in two phases:

•Analysis and Export

•Import

In the Analysis and Export phase, you identify the objects that you want to export into 4.x. The Migration utility analyses the objects, consolidates the data, and exports it.

After the Analysis and Export phase is complete, the Migration utility generates a report that lists any data compatibility errors, which you can manually resolve to successfully import these objects into new ACS.

The Analysis and Export phase is an iterative process that you can rerun many times to ensure that there are no errors in the data to be imported. After you complete the Analysis and Export phase, you can run the import phase to import data into ACS.

For complete step by step configuration, please go through this link:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/common_scenarios.html

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Fri, 27 Sep 2013 04:05:59 GMT

Muhammad Munir

What you're suggesting here is called migration from acs 4.x to 5.2. That's NOT a question.

He wanted to apply the latest patch of ACS 4.2.1.15 ....patch 11 and that is what Adil concerned about.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Mon, 30 Sep 2013 10:00:30 GMT

Were you able to install the latest patch 11 with the help of readme file attached and suggestions provided in my last post?

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

adil.nasser3 — Mon, 30 Sep 2013 14:52:17 GMT

Hello Jatin,

I haven't performed the patching yet. This is still in planning stage but I do have another question:

Is there a particular sequence for installing the RA patch and ACS SE patches or doesn't it matter? Also, will the patched ACS SE work with an unpatched Remote Agent until I have a chance to do it? In other words, is there a dependency between the two patching activities?

Adil

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Mon, 30 Sep 2013 15:01:43 GMT

The same patch should be applied on both the sides (ACS SE and Remote agent). It won't work until you patch both the devices with same code. The ACS can only communicate with AD only if they're running on the same code and patch. There is no such sequence, you can start from any of those 2 devices. We generally patch ACS SE first and then remote agent server.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

adil.nasser3 — Tue, 01 Oct 2013 14:42:04 GMT

Hello Jatin,

The step by step procedure for performing the patching of ACS SE involves some steps at the CLI. Can you point me to a step by step procedure for performing all of the steps using the web interface (including the stopping and starting of services)?

Adil

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Tue, 01 Oct 2013 15:13:58 GMT

I don't see patch installation step-by-step documented somewhere because its same as applying upgrade and simple too. Here are the steps you need to perform.

1. Download patch zip file to any PC which we will call the Upgrade Server or distribution server.

2. Unzip the patch

3. Execute autorun.bat (you will see an ACS Appliance Update window appear and it remains in the back ground.

You will also see another IE window lauch that give you a place to put in the IP address or host name of the appliance)

4. Enter in the IP address or host name of the appliance and click Install.

5. This will bring to the logon window for ACS appliance.

6. Log into ACS

7. Click on System Configuration

8. Click on Appliance Upgrade Status

9. Click on Download

10. Enter in the IP address Upgrade Server and click connect

11. You will see the patch that you are trying to install. Click Download Now

12. Click Download again.

13. Click Apply Upgrade

14. Click upgrade again.

15. Click Yes

16. Click Yes again.

17. Click Done.

18. On the Upgrade server click "Stop Distribution Server".

In order to stop csagent, go to system configuration > appliance configuration ( I think so)

P.S. Please open a TAC case if you're not comfortable in applying patch.

~BR
Jatin Katyal

**Do rate helpful posts**

ACS 4.2 to 4.2.1 Upgrade Questions

adil.nasser3 — Thu, 03 Oct 2013 17:31:14 GMT

This information is very helpful. Now I feel I am ready to proceed with patching our ACS appliance. Thank you very much.

ACS 4.2 to 4.2.1 Upgrade Questions

Jatin Katyal — Thu, 03 Oct 2013 17:34:18 GMT

In addition to that, I'd suggest to read all warning messages before proceed.

Post your question back if you need some more clarification.

~BR
Jatin Katyal

**Do rate helpful posts**