Cisco ISE 2.1 Patch Update

[dot1x]

Hi All,

Could someone please assist how long does it take to apply patch on Cisco ISE (distributed environment).

We have 1 PAN, 1 SAN, 3 PSNs running 2.1

Thanks.

[Damien Miller · Accepted solution]

I would plan for about 45 minutes a node. Each node will reload after patch instalation. 

[hslai]

For production, I would suggest to apply patches via CLI because this way gives us a better control when and which ISE nodes to start patching and possible to do a few ISE nodes at the same time. Please remember to take an ISE CFG backup beforehand.

[dot1x]

Thanks for response.
If we go with CLI, is there any specific sequence we should follow?
Also, what would be the downtime for the users?
Thanks.

[hslai]

First to the primary ISE node and the rest can be in any given order. Best to schedule a maintenance window and use a load balancer to take patching PSNs offline or online.

[dot1x]

For 5 nodes deployment, a maintenance window of 5 hours would work?

[Damien Miller]

Start with the primary admin node, then choose the node order you want after that. 5 hours should be enough for five nodes.  

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100.html#ID202
"If you are installing the patch from the CLI, you can control the order in which the nodes are updated. However, we recommend that you install the patch on the Primary PAN first."

You will use the command "patch install <patch name> <repo name that has patch file>"

The impact to users and services depends on which node is patching and your HA config. If you have redundant radius servers configured on your NAD's then user impact should be relatively minor.

Read this section of the admin guide to see what will be unavailable while the primary admin node is down/patching.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010.html#ID59

[dot1x]

Thanks guys!