Hardware Migration from 36xx to 37xx

[santhoshkdhanapal]

Hi All,

   Kindly suggest the prequiste to be considered when migrating ISE hardware from 36xx to 37xx and current ISE version is 3.0 . Which version is the stable version ? I worked in ISE 3.2 but with TAC cases ,they recommend so many patch to update. Please share any documents or your previous experience with respect to migration of ISE hardware and backup restore. I appreciate in advance. 

Cheers,

Santhosh

[Mark Elsen · Accepted solution]

                        >...Which version is the stable version ?
         https://software.cisco.com/download/home/283801620/type/283802505/release/3.3%20Patch%202
         Is currently recommended version ; note that link is only summary you must first install and or upgrade to 'full'
        3.3  and then install patch2.

      Note that your question consists of two parts, upgrading and moving to new hardware  , for upgrading
      consult : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/Cisco_ISE_3-3_Upgrade_Journey.html
    (edited/added) : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf)

        For the new hardware : possibly a configuration backup and restore on that can be done from your current ISE
                                            version ; check the previous document (link) mentioned for info's on that.
       My advices : take the whole project out of a production environment and test first when finished (e.g.)
                           Consider building it from scratch and configuring the policies manually
                           Test before 'returning' the new hardware device(s) to production!

  (edited2/added) : Appendix : https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2889.pdf
  (edited3/added)                     https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/release_notes/b_ise_33_RN.html

  Also note from the above : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/release_notes/b_ise_33_RN.html#concept_vlf_w5f_rsb
  

 M.

[santhoshkdhanapal]

Hi @Mark Elsen ,

Thanks for the response. In new hardware ie 37xx we restore the configuration backup. what's the status of old hardware when i do migration ? Do i keep both hardware appliance up in production or how does it work ? And the certificates backup need to be restored separately , is it correct and how about license?

[Mark Elsen]

         >.... In new hardware ie 37xx we restore the configuration backup. 
  - First , it's better to have ise 3.3 with patch2 installed first and then restore a configuration backup from the 3.0 environment
     to have an easy work flow

                         >...Do i keep both hardware appliance up in production or how does it work ? 
   - In whatever topology concerning management and policy server nodes (PAN,PSN,MNT) , you can't have mixed versions.

  M.