ISE 2.7 upgrade to version 3 patch 4

[Gouthami Nair]

Hi All,

We are currently using Cisco ISE 2.7 version patch 8 and planning to upgrade to version 3.1 Please let me know whether any known issues reported in patch 4 ? Are there any reported issues during the upgrade such as configuration sync etc..

[Marcelo Morais]

Hi @Gouthami Nair ,

 I didn't have issues from 2.7 P8 (Nov 21th) to 3.1 P4 (Sep 22nd).

Note: attention to the following

• CSCwd45843 Auth Step latency for policy evaluation due to Garbage Collection activity., solved in 3.1 P5.
• CSCwc74531 ise hourly cron should cleanup the cached buffers instead of the 95% memory usage, solved in 3.1 P5

Hope this helps !!!

[Arne Bier]

My own personal experience with 3.1p5 was that Cisco Phones whose EAP-TLS certificate was signed by Call Manager (CAPF cert) would fail - ISE was complaining about failed SSL decoding. We had to revert back to patch4 and then the phones started working again. 

We have not tried patch 6 

[Damien Miller]

I would recommend two things for you.

1. Install 2.7 patch 9 prior to upgrading, this will limit the amount of change you experience going to 3.1 since many of the fixes in 2.7p9 are also built in to the 3.1 patches. 
2. Target 3.1 patch 6 as your post upgrade release. Patch 6 includes an additional 87 publicly acknowledged bug fixes and a few that are quite severe in p5 hit. It also provides for the workaround with TPM stored certs on windows machines.