ISE add unpatched v2.6 node to patched v2.6p7 deployment - will it work?

[SergGu]

Hello Cisco ISE Experts,

I checked documentation including patching FAQ and prior forum post and not clear what happens when one tries to new node to ISE deployment. Assume existing deployment is running with Patch N while the new node is just factory wipe (e.g. no patch).

Will it join and run happily ever after? Or will it be patched during join process?

Perhaps the node need to be patched before joining to ISE deployment. Here is good document describing step by step CLI patch deployment process - https://dependencyhell.net/2020-05-19-ise-standalone-patch/

Regards,

Serg

[Damien Miller · Accepted solution]

If you try to join an unpatched node to your deployment it will give you an error stating the new node is not patched. 

You need to patch it either through its gui or cli. From the cli it's quite easy, patch install <patch file name> <repo name>. The only caveat here is you need to define the repository first, either from the gui or cli. 

If you have the patch file locally, patching the new node from the gui just requires visiting the patch install page and selecting the file. 

---

[SergGu]

Thank you for the explanations. I will modify my planned work script. I somehow thought that GUI patching option is only available once ISE is part of the deployment, and not present while ISE is "virgin" just configured state.

It is shame Cisco does not provide slipstream ISO images with patches blended in.