ACS 5.7 to ISE 3.x in Azure Upgrade

[simah78]

Hi All,

I am currently tyring to updage ACS 5.7 with patch4 to ISE 3.X and the traget location for ISE 3.X is Azure Cloud. Have not seen any upgrade guides and things to consider to perform this upgrade.So if someone who has done this can shed some light to this process that would be a great help.

Thanks,

Simah.

[balaji.bandi]

There are some tools used long back ACS to ISE 2.X version, but sure ISE 3.0 changed lot now

check some guide help you :

https://www.youtube.com/watch?v=YFobxmbeC-8

[Greg Gibbs]

ACS is long past the end of support. I believe the last ACS Migration Tool supported migration to 3.0, but I don't believe that tool is even available publicly any longer. You would also have to upgrade from your current version to 5.8 patch 4, perform the migration, then update from ISE 3.0 to 3.2 for native Azure support. You would have to do all of that on-prem, then backup the configuration and restore it to a 3.2 instance in Azure.

You would be much better off starting from scratch with ISE 3.2 in Azure and rebuilding your policies based on current business/technical requirements.

[Marvin Rhoads]

Same answer I gave in the Partner Security discussion space.

https://community.cisco.com/t5/security-discussions/upgrade-acs-5-7-to-ise-3-x-in-azure/m-p/5096510#M4941

Please don't make duplicate posts.

[balaji.bandi]

@Marvin Rhoads   is there any public available that information, some how not able view that document suggested.

[Marvin Rhoads]

@balaji.bandi here is the answer I posted in the Partner space (more or less what @Greg Gibbs said):

Yes, the tool is still there for ISE 3.0 which is almost at end of software maintenance.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-0.html

ISE running natively in Azure cloud was only introduced in ISE 3.2. https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/release_notes/b_ise_32_RN.html#concept_ich_dws_h5b

Theoretically you could build a temporary server on premises with ISE 3.0, migrate your ACS configuration to it, create a backup there and then restore that into ISE 3.2+ in Azure.

I'd still suggest the path of rebuilding from scratch since that ACS server must not have had much attention having gone so long past end of life without being migrated already.