Downgrade ISE version 2.7 to 2.4

[Juan Marilaf Millahual]

Hi

I need to upgrade ISE from version 2.4 to version 2.7. Is there any method to downgrade to version 2.4 if required? I need to know this in case it is necessary to go back. In Cisco it is not documented if it can really be don

[Francesco Molino · Accepted solution]

Hi

There's no official downgrade supported procedure.
Is it a virtual appliance or physical?
If virtual appliance, i would shutdown the vm and take a snapshot, so you can restore it afterwards.
If it's a physical appliance, you reinstall using the iso and restore a backup or use a tool like acronis to restore it the way it was before.

[poongarg]

There is no option to downgrade the ISE. If after upgrade, you want to go back to older version, re-image is the only option for both VM and appliance as snapshots are not officially supported for ISE.

Once re-imaged, restore the backup taken on that specific version earlier.

[marce1000]

 - Why do you need to downgrade ?

 M.

[Juan Marilaf Millahual]

Hi

Only for eventual problem after the upgrade To 2.7

[Noclss2000]

how is your ISE running on 2.7?
we have a new implementation migrating from ACS to ISE 2.7 and so far in prepping these servers we've had nothing but issues.
there's bugs we are hitting out of the box with the device admin service intermittently stopping/starting and randomly unable to ssh into the boxes (physical 3595 and a couple 3655 boxes). we're on our 3rd tac case being opened:
case 1 for acs to ise migration tool not working. haven't gotten anywhere with that and have started manually re-creating policies
case 2. tacacs stopped working in ISE, this is where we found the services having issues. they recommended upgrading to 3.0 against many people's suggestions. But we were deciding to try it anyways.

case 3. upgrade to 3.0 not working correctly, even in CLI. we are taking the steps in which boxes to upgrade in what order. The upgrade is stopped because ISE is complaining about having 2 mnt nodes and one must be offline. we did that and it's still complaining about it.

our SE is involved now and he's been asking around. He stated NOT to go to 3.0 so not sure what else to do since 2.7 has been a trainwreck. thinking of going to 2.6.

[Marcelo Morais]

Hi @Noclss2000 ,

 first of all ... version 2.7 P2 was released on Jul, 21th 2020, version 2.4 P13 was release on Aug, 13th 2020, version 2.6 P8 was released on Oct, 22th 2020 and version 3.0 P1 was release on Dec, 10th 2020 ... the next patch will probably be 2.7 P3.

 Second ... if my understanding is correct, you have two issues:

1. ACS to ISE Migration ... not working.

2. TACACS ... not working even after a new installation (2.7 P2 or 3.0 P1) 

Testing TACACS on a new installation of version 2.6 P8 is a good action plan.