This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Administrator guide introduce different ways to restore operational backup for each deployment when using GUI. It explains deregistering is required before performing restore.
Solved! Go to Solution.
Just to share my experience...
I did restore on the Primary node via CLI from 1.4 Configuration Data to 2.0.1 on a 2-node deployment, without deregistering the nodes. At the end of it, the restore function completed successfully, confirmed by command output of show restore history. Then I logged into the Primary, found out it has been put to Standalone deployment.
Thanks for sharing your experience, Ping.
With your comment, I noticed the guide doesn't cover 2 node deployment. Now GUI covers standalone and distributed. I also want to know about that.
It looks like CLI steps are missing the information on the distributed deployment, I will work with the doc team to address this. I understand why the customer would want to avoid deregistration, but please follow the steps outlined on the GUI backup/restore procedure.
I tried "Backup with Administration and Monitor Personas" scenario for 2 node deployment, but got abnormal result.
"Show details" on live log or report doesn't show actual information and only show following message.
Does it mean "Backup with Administration and Monitor Personas" scenario can't be applied to 2 node deployment? Please tell me correct restore procedure for the deployment.
My Test Environment.
- 2 node deployment
- Both ISE are VM appliances and running with 2.4 patch2
- At the beginning of the verification, ISE1 is primary PAN/primary MnT/active PSN. ISE2 is secondary PAN/secondary MnT/active PSN.
My Test Steps.
Step1: On ISE1 (primary PAN/primary MnT/active PSN), collect Operational Backup via "Backup now" menu.
Step2: Purge all data via Purge data now.
Step3: Promote ISE2 (secondary PAN/secondary MnT/active PSN) to primary.
After that, ISE2 became primary PAN/secondary MnT/Active PSN.
Step4: Deregistered ISE1 from the 2 node deployment.
Step5: Restore operational data with backup collected at Step1.
Step6: Register ISE1 from ISE2 GUI.
Step7: Promote ISE1 to primary.
After that, ISE1 became primary PAN/secondary MnT/Active PSN.
Step8: See some report or live log and click details. But it didn't show information and only show "No Data available for this record. Either the data is purged or authentication for this session record happened a week ago.
Or if this is an 'PassiveID' or 'PassiveID Visibility' session, it will not have authentication details on ISE but only the session.
From administration guide...
Before you begin
Purge the old monitoring data.
Schedule a backup or perform an on-demand backup.
Prepare to promote another Cisco ISE node as the PAN, by synchronizing the node with the existing primary node you want to backup.
This ensures that the configuration of the Cisco ISE node you are going to promote is up to date.
Promote the newly synced Administration node to primary status.
Prepare to deregister the node to be backed up by assigning the Monitoring persona to another node in the deployment.
A deployment must have at least one functioning Monitoring node.
Deregister the node to be backed up.
Restore the Monitoring backup to the newly deregistered node.
Register the newly restored node with the current Administration node.
Promote the newly restored and registered node as the PAN.
Looks to be defect. I filed it but unicast me directly if defect ID is needed. email@example.com