When you say the secondary node went down, what do you mean? it crashes if you try to power it on? one thing to keep in mind is that you can reset ISE application using the command application reset-config ise which will reset ISE application keeping the certs and the node networking configs. Regarding upgrading the new node to version 2.7, although you could do this, however, in this case you would need to configure this new node as a standalone node as you can't mix versions within same deployment, so you need to configure everything on it as I don't believe you can restore the backup from taken from a different version, and you also need to import the certs. Then once the new node is completely configured, you need to change the order of the RADIUS/TACACS servers on the NADs to point to it, that's to allow you to start upgrading the other node to version 2.7. Once that is upgraded you need to form the deployment, and change back the RADIUS/TACACS servers order on the NADs. As you can see there is no advantage in doing this, and it actually introduce some unnecessary works. Best approach would be to rebuild the new node with the same exact version and patch as the existing one. Join it to the deployment, wait for them to synch up, and then, you can undertake the upgrade process to version 2.7 which will bring both of them to that version with minimum downtime, as it will always start with the secondary PAN, and won't go ahead upgrading the primary PAN unless the secondary PAN has been successfully upgraded and promoted to be the new primary.
