How to split a Cisco ISE two-nodes-HA setup [EDITED]

[GioacchinoInfanti]

Hi,

the closest answers to my question would be these

https://community.cisco.com/t5/network-access-control/ise-split-deployment-question/m-p/4560826

though in my case i have two 3615. After having read it, I haven't understood how I can split them.

What I would do is to move all the primary roles onto one node and then detach the other.
I know how to move roles but I don't know how then detach the host that will hold the secondary roles.

The idea is to install the latest 3.2 or 3.3 on the detached one, restore the backup, (install the licenses due to the new model) test it for a couple of days in parallel with the old one. Once we have proof that the new version works, then will wipe the older version and install the latest release and join it to the active one.

Does it make sense? And how will I practically do it?

TIA, Gio.

[ahollifield]

Go the to the Deployment page and deregister the secondary node.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/admin_guide/b_ise_admin_3_2/b_ISE_admin_32_deployment.html#ID185

[GioacchinoInfanti]

Thanks @ahollifield ,

I think it would be better to have all the primary roles on the primary PAN, before de-registering the second node, hence I have to modify the roles.

Then I can proceed by unregistering the second node.

Thanks, Gio

[ahollifield]

Correct, move all roles to primary on the Primary PAN.  Then deregister.

Also, why do you have only one pxGrid node?  Why is Profiling also enabled only on one node?  Do you have Advantage Licensing for profiling and pxGrid?

[GioacchinoInfanti]

Hi @ahollifield ,

thanks for confirming my next step.
As to your question, I wouldn't know. I have inherited this setup and hence I assumed it was a stable baseline. If you say that's not normal, I would really appreciate to know why. Cisco ISE is complex and so far I have only worked on configuring policies, I haven't had the opportunity to touch the pillars of a new deployment.

Moreover I found this guidelines, I made comments to better tailor them for a two-nodes setup like the one I have.
If you could quickly review it and let mew know if ther eare any mistake, I would appreciate very much.

Upgrade Secondary PAN and MnT Nodes to Cisco ISE, Release 3.2
Procedure

v Step 0 Make just one node Primary for PAN and MnT
v Step 1 Take a backup of Cisco ISE conguration settings and operational logs.
v Step 2 De-register THE secondary PAN node (there can be just two PANs, hence there is only one secondary)
v Step 3 Re-image the deregistered secondary PAN node to Cisco ISE, Release 3.2.
v Step 4 Restore ISE conguration from the backup data and make this node as the Primary Node for your new deployment (being Primary is automatic, isn't it?)
v Step 5 Import ise-https-admin CA certicates from the backup for this node unless you are using wild card certicates (OK)
? Step 6 De-register Secondary MnT node. (in a two-nodes setup this step isn't possible, is it? I can just proceed ontp the next one, right?)
v Step 7 Re-Image the deregistered Secondary MnT node to Cisco ISE, Release 3.2.
- Step 8 Restore your current ISE operational backup and join node as Primary MnT for new deployment. This is an optional step and needs to performed only if you need to report of the older logs.

Also, when restoring the configuration backup, are IP addresses taken from the backup, meaning that I may loose connectivity if doing the restore from the Web GUI?

TIA, Gio

[ahollifield]

So if you only have essentials licensing, you should disable Profiler and pxGrid on your nodes as you are not entitled to those features.  If you do have the licensing and are using the Profiler and pxGrid you should enable those on both nodes for redundancy purposes.

Do you need the operational data?  Otherwise I wouldn't bother backup/restoring that.  It will add significant time to your upgrade to restore the logging/reporting data.   You also do not need to import the backup twice.  When you join the the second node to the deployment the configuration database will be downloaded.  There are also multiple upgrade specific webinars on the ISE YouTube channel here: https://www.youtube.com/@CiscoISE

Network settings are not restored as part of a backup restore unless you use the "include-adeos" keyword when restoring the backup.

[GioacchinoInfanti · Accepted solution]

Thank you @ahollifield ,

it's clearer now. As to the profiler and pxGrid, after checking it I saw indeed that we use it and there are many connections; I don't know why is not enabled on all the nodes.

I had a look more in detail and this is what I have found

I guess the majority of the clients are the two ISE themselves. There are two generic clients, one offline and the other one who's waiting for "getting in" (status), I wouldn't know what they are. Moreover if so far they have been in such state maybe we don't need them, and hence if the self-referenced clients (ise1-ise2) are the only ones, maybe I can completely turn off the pxGrid feature .

Also, I read that upgrading from 2.7 to 3.2 pxGrid v1 won't be supported anymore, hence I should check which version we use, but how do I see that?

I apologize to ask questions along the way, but your precious help is helping me in discovering the real status/health of our setup.

TIA, Gio

[hslai]

@GioacchinoInfanti You are correct that those pxGrid client names ending with "ise1" or "ise2" are for ISE itself. The two with pxgrid_client in the names look to be Cisco Catalyst Center (formerly Cisco DNA Center). As they are either offline or pending, my guess is that the integration was attempted but did not complete. If you have no other clients, then you may disable pxGrid service.