I suppose it is a coincidence that I am checking the forums as I wait for my transition from 2.3 -> 2.4 and stumbled upon this post. Here is my scenario:
Was running 2.3p5
Planning on getting to 2.4p5
2 PANs 2 PSNs
A few weeks ago I ran the URT and it estimated 7-8 hours. This morning once I got the bundle and everything squared away on my linux repo the PAN GUI stated for all 4 nodes it would take 960 minutes (16 hours), which is false. Ensure your customer has, at a minimum, configuration backups prior to doing anything. Also, I recommend performing the upgrade via CLI. I had issues with the GUI this morning due to some expired certs and other issues. Make sure name lookups work as well. The move I performed for the 4 nodes is as follows:
move secondary PAN to 2.4.x (now is the new PAN until later on)
move PSN1 to 2.4.x (during this move PSN2 with the original PAN will still be servicing requests)
Ensure that PSN1 is functioning as expected for policy services requests by checking radius live logs on secondary PAN on 2.4.x which actually gets promoted to PAN
Once that is confirmed, move PSN2 to 2.4.x and the new 2.4 cluster (now PSN1 is servicing all NAD requests)
Finally, move original PAN; Once moved over promote to primary again;
Apply whatever patch, if necessary after bundle upgrade success
If applying patches, it should take maybe an hour depending on the size of course.
If your NADs are configured to utilize the distributed deployment there should be no outages if things transition smoothly. A workaround, peace of mind, could be having your customer extend the reauthentication timers in the authorization profiles to something like 15 hours, ensuring hosts authenticated and will not reauthenticate again for X amount of time. This could potentially help them if they encountered issues with both PSNs during the transition. Keep in mind that each deployment scenario are unique, but this general approach should be similar. Good luck & HTH!
