Configuration backup, what does it contain?

[dgaikwad]

Hi Experts,
Planning to perform a backup and restore upgrade from version 2.2 to 2.7.

Before I could start performing this action, wanted to understand what does the configuration backup capture.
What are the other backups that I would be needed to capture for the upgraded version?

[ahollifield]

You really should look at starting over manually if the policy sets aren't too involved.  The ISE policy engine changed completely in ISE 2.3 and your 2.2 policies will be automatically converted and most likely will be a total mess.  

The backup contains everything you need to restore (including the ADE-OS information if you choose to restore that).  

[Marvin Rhoads]

Whether or not you follow @ahollifield 's suggestion you will also need the system certificates from the current deployment. The ISE Upgrade Guide is quite thorough in telling you what to do and in what order. If you folllow carefully it will serve you well.

[dgaikwad]

The restore for the backup was successful and what I see is that as per the new policy set, it just created that many policy sets as there were authentication policies on the older version.
Like 04 authentication policies create 04 policy sets with all the authorization rules copied to them.

So clean up will be another project in itself!

[ahollifield]

Yes, that is to be expected when coming from 2.2 and earlier. That’s why I mentioned my preference is just to re-write from scratch when possible.

[ahollifield]

Also some more links to help:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/upgrade_guide/Upgrade_Journey/HTML/b_upgrade_method_2_7.html

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

Note that 2.7 does have an EOL announced^^^ ISE 3.1 is currently the Cisco suggested release. 

[dgaikwad]

Yes, did a little experiment to find out and seems that the old 2.2 version policy sets were converted to new policy sets of 2.7.
Also, while doing the restore using command line, there was no option provided to restore the ADE-OS configuration.

What would be command to restore ADE-OS configuration as well?

[Greg Gibbs]

The 'include-adeos' option is available after the password as shown in the CLI Reference Guide.

[dgaikwad]

Now that I have already restored the configuration backup and would like to only restore the ADE-OS configuration.
If I proceed with the same command, then it will restore everything that is there in the backup...
Any idea how to restore only the ADE-OS backup now?

[ahollifield]

You cannot. It must be done at the time of restore. You will need to restore the entire backup again and include that option.

[dgaikwad]

Makes sense and in case where I need to only restore the ADE-OS configuration?
Is that similar to changing the running config with another config file?

[Marvin Rhoads]

The ADE-OS configuration is quite minimal and often just as easily restored from the cli. It's what you see when typing "show run" at the cli.

[dgaikwad]

I am trying to find such a document for it, but not able to find any.
Could you please point me to one if you have one handy?