ISE 2.7 VM to 3.3 upgrade

[RamsesDE]

Hi all,

Wondering what is the best way to upgrade ISE VM's (PAN/PSN and SAN/PSN) from 2.7 to 3.3 patch 3.

I'm planning to do Backup&Restore method into 2 new VM's (assign temp IP addresses then change these to the production ones, when finished).

Should we perform this in a 2-staged upgrade (2.7->3.2 then 3.2->3.3)? or can we restore the 2.7 backup directly to 3.3?

No use for profiling, BYOD or posture (just features covered by Essential licenses )

Certificates will be re-imported and AD Joints restored later on.

Do we generally do the Restore before or after the Patch install?

Appreciate your feedback

[Aref Alsouqi]

I would do it in the same way as you mentioned by spinning up two new nodes with ISE 3.3 installed, and then import the config backup. Importing the config backup would be done at the very end after ISE 3.3 latest patch has been installed. The certificates would be included in the backup, but as a best practice I would recommend exporting them from the current ISE deployment just in case. One thing to keep in mind is that with ISE 3.3 the licensing model has changed compared to version 2.7. With ISE 3.3 we can't use the traditional licenses any longer and we have to use smart licensing. Because of this you would need to engage with Cisco licensing team asking them to convert your traditional licenses to the new formatting. If you are using smart licensing in ISE 2.7 you still need to engage with Cisco licensing team to convert the old licenses to the new ones (R-ISE-VMC-K9). Usually Cisco licensing team issues a new temporary licenses set to be used in your current ISE deployment to allow you some time to migrate from 2.7 to 3.3 without any disruption. Once that grace period of of the temporary licenses expires the temporary licenses will be removed and you will only find the new licenses into your smart account. Also, please keep in mind that if you want to restore the underlying configs such as IP addressing then you can use the keyword "include-adeos" to the "restore" command in CLI.

[RamsesDE]

Hi Aref,

Thank you for the feedback.

The licensing has been taken care of (purchased new ones, since last date of conversion has already expired).

AFAIK, the ISE certificates themselves are not included in the backup and need to be re-imported with their private keys (from a previous export).

So you agree on getting directly to 3.3p3 for the restore without passing through 3.2?

thx again

[ahollifield · Accepted solution]

https://community.cisco.com/t5/security-knowledge-base/ise-version-upgrade-matrix/ta-p/3653501

[RamsesDE]

Thank you Ahollifield,

That matrix confirms that I need to perform a 2-staged install if using Backup&Restore. I will do 2.7->3.x (0,1 or 2) then 3.x->3.3

Thank you all

[Aref Alsouqi]

Hi. Just to clarify what I was referring to wasn't an upgrade approach, it was instead spinning up new VMs with ISE 3.3 and then import the ISE 2.7 backup on them. This is basically a parallel deployment to your existing one, not an actual upgrade and this is what we refer to as "Backup & Restore" approach. However, if you want to upgrade the existing 2.7 to 3.3 then as shown in the link shared by @ahollifield you have to go to 3.2 first and then to 3.3 and in that case you don't have to rely on the "Backup & Restore" as the upgrade will be done on top of the existing config you have in 2.7. Regarding the certificates, I'm pretty sure I'd gone through some investigation a few years back and found out that when you do the config backup ISE includes the certificates in the backup, I could be wrong, but this is what I remember.

[lisacoody]

I'm also upgrading from version 2.7. I'm curious... Did you backup and restore to 3.0, 3.1, or 3.2 before going to 3.3? 

Thanks!

[ahollifield]

Go 3.2. With latest 3.2 patch.

[Marcelo Morais]

Hi @lisacoody ,

 beyond what @ahollifield already said ...

 Make sure that you are using the latest Patch of your Release, before any major upgrade:

• ISE 2.7 P10 > ISE 3.2 P7 > ISE 3.3 P6

Make sure that your Hardware is compatible with the new Release:

• please take a look at ISE - What we need to know about SNS / VM > search for Cisco ISE Compatibility

Note:

• ISE 3.3 have parity with ISE 3.2 Patch 2.
• ISE 3.3 P6 is Cisco Suggested Release

Hope this helps !!!

[lisacoody]

Marcelo,

Thank you very much for taking the time to help me out - your advice is greatly appreciated!

I have a two-node cluster on version 2.7 (patches 2, 4, 9). I've already pre-staged two nodes on version 3.2 (no patches) using the same name, but different (temporary) IP addresses. I'm planning to do a backup and restore upgrade tomorrow. I've run the health check and URT bundle and all looks good. The new nodes are on Nutanix hardware.

The existing cluster does not have P10; should I do install it first? Run the URT bundle again, then take backups once more before restoring on the 3.2 nodes?

The new 3.2 nodes do not have patch 7 installed yet. Can I do that before I restore from backup or should I wait until after the restoration of both nodes is complete?

Thanks in advance!

[Marcelo Morais]

@lisacoody ,

 keep in mind that if you have a 2-Node Cluster, for ex: Node 1 (PPAN/PMnT/PSN) and Node 2 (SPAN/SMnT/PSN), you can:

• de-register Node 2 from the Cluster
• update to ISE 2.7 P10
• upgrade to ISE 3.2
• update to ISE 3.2 P7
• upgrade to ISE 3.3
• update to ISE 3.3 P6
• test Node 2 with the new Release
  1. If everything is OK, install Node 1 in ISE 3.3 from scratch, update to ISE 3.3 P6 and register it to the Node 2 Cluster
  2. If you have issues, install Node 2 in ISE 2.7 from scratch, update to ISE 2.7 P9 and register it to the Node 1 Cluster

Note: if you have a 3rd Hardware, you can perform all of the above steps without changing your Production environment, untill the last step.

Hope this helps !!!

[lisacoody]

Thanks for the advice, Marcelo. I hadn't thought about doing it that way before. 

[Marcelo Morais]

@lisacoody ,

 don't worry ... keep that in mind for next time ...  :  )

Is there anything more I can do for you ?