Cisco ISE 2.4 to 3.1 Migration, including Change of IP due to DC move

[anup.kandpile]

Hi,

We are planning a DC migration and the Cisco ISE 2.4 needs to be migrated over to the new IP Space. We want to keep the old one running to support existing devices before/during/after the migration.

Since we are going to spin up a new VM, we are hoping to go directly to 3.1 and copy the configs over from the old server. The only changes would be the change of IP for the primary and secondary server in the new DC.

Any documentations / steps that you can point to would be of great help.

Thanks

[thomas · Accepted solution]

You cannot go direct from ISE 2.4 to 3.1 - only to 3.0 by actual upgrade.

You would need to do a backup and restore process from 2.4 onto your new ISE node with new IP on 3.1.

You should be joining our ISE Webinars and/or watching them on our CiscoISE YouTube Channel where we talked about upgrading to 3.1:

Upgrading your Cisco ISE Deployment

Learn the options to migrate your ISE deployment to the latest version. This will prepare you with strategies to upgrade your deployment to take advantage of the latest features.
You will learn :

• what changes went into the latest patches and previous releases
• how upgrades are more reliable
• your available upgrade options
• pre-upgrades, methods for upgrade as well as post-upgrade tasks
• best practices for migrating your ISE deployments

00:20 Agenda
01:44 ISE Versions and Suggested Releases
02:57 ISE 3.1 Release Features
03:40 Supported Releases for Upgrading to ISE 3.1
06:02 Upgrade Workflow
07:04 Upgrade Methods: Backup & Restore, GUI, or CLI
11:00 Upgrade Preparations: Backup, Certs, Health Check
14:32 Upgrade Options Overview: Split and Full Upgrades
17:40 Full Upgrade Process Details
21:28 Upgrade Pre-Checks
27:09 Demo of Full Upgrade from ISE 2.7 to 3.1
38:45 Split Upgrade Process Details
44:11 Demo of Split Upgrade from ISE 2.6 to 3.1
52:38 Split vs Full Upgrade Process Comparison
54:38 Post Upgrade Tasks
56:13 ISE Upgrade Resources

• https://cs.co/ise-3-1-upgrade
• https://cs.co/ise-rn
• https://cs.co/ise-license-migration
• https://cs.co/URT-overview

[jacob.fredriksson]

I realizes this thread is a few months old, but I am in a similar situation about upgrading ISE 2.4 to ISE 3.1

Is the Backup & Restore method really supported for this big jump in versions? I've seen multiple threads on this forum and other places they've had successful upgrades doing this, but the official Upgrade Method guide says you have to have "ISE 2.6 or later" even for the Backup & Restore Method.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/upgrade_guide/HTML/b_upgrade_method_3_1.html#id_121933

Could this just be a typo in the guide? Since "ISE 2.6 and later" is stated in every scenario, maybe it's just a copy/paste error.

[ahollifield]

If I understand correctly, the backup must also be from 2.6 or later.  The backup/restore method is what I typically recommend to all of my customers, regardless of size.  So in your case, you would spin up a temporary 3.0 node, install the latest patch, import your 2.4 backup, export that 3.0 backup, deploy your new 3.1 admin node, and import the 3.0 backup.  

[Marvin Rhoads]

It's as @ahollifield mentioned already. Also note your licenses will have to migrate to Smart and use the new Essentials/Advantage/Premium style vs the old Base/Plus/Apex. A TAC case is required for that. If you are using VMs, you will also need VMC (Common) licenses, a no cost "upgrade" which must be ordered via your reseller.

[Kichan]

I hope you are very well dear friends.

I have a very similar case to the one you mentioned.

We currently have ISE 2.4 and as an improvement it has been decided to implement a new virtual machine and install ISE there, right now the recommended version is 3.1.

From ISE 2.4 I made the configuration and data backups, then having deployed ise 3.1 and when doing the restore I got problems due to the version, it said that the minimum required was 2.6 onwards.

Where do I find this information about the steps to get from version to version?

On the other hand, reviewing the recommendation and this forum, we decided to remove ISE 3.1 and set up ISE 3.0, right now we are restoring the configuration and data, I hope it can go smoothly this time.

Please, if you know or have had a similar case, I will be grateful if you can share it with me.

[ahollifield]

https://community.cisco.com/t5/security-knowledge-base/ise-version-upgrade-matrix/ta-p/3653501