Cisco ISE upgrade from 2.7 to 3.1

[guyglikson1]

Hello,

I am going to upgrade ISE in my company from 2.7 to 3.1 patch 5.

I will follow the official guidelines but I have some questions which I would appreciate If you can answer.

1. I Have 2 nodes containing all the roles (pan+mnt+psn+pxgrid), I want to upgrade them Separately via GUI, what is the best practice regarding to the order of upgrade, should I upgrade the secondary node first and then the primary? To my understanding it is better to upgrade the primary one first. all deviced will contact the secondary one (2.7 version) when upgrade is complete they will contact again the primary node (3.1). if everything goes well on the new version (like I see live logs authentication success)

than I will upgrade the secondary one and rejoin them. if not i will be able to downgrade primary back to 2.7.

Am I missing something?

2. I took conf and opt backups + backed my certs. from your experience is there anything else important (that is not mentioned in the guideline) to look out for?

3. Has anyone experienced any undocumented issues regarding to those specific ISE versions?

Thank you!

[thomas · Accepted solution]

▷ Upgrading your Cisco ISE Deployment 2021/09/07

00:20 Agenda
01:44 ISE Versions and Suggested Releases
02:57 ISE 3.1 Release Features
03:40 Supported Releases for Upgrading to ISE 3.1
06:02 Upgrade Workflow
07:04 Upgrade Methods: Backup & Restore, GUI, or CLI
11:00 Upgrade Preparations: Backup, Certs, Health Check
14:32 Upgrade Options Overview: Split and Full Upgrades
17:40 Full Upgrade Process Details
21:28 Upgrade Pre-Checks
27:09 Demo of Full Upgrade from ISE 2.7 to 3.1
38:45 Split Upgrade Process Details
44:11 Demo of Split Upgrade from ISE 2.6 to 3.1
52:38 Split vs Full Upgrade Process Comparison
54:38 Post Upgrade Tasks
56:13 ISE Upgrade Resources

https://cs.co/ise-3-1-upgrade