ISE cluster upgrade

[manvik]

ISE nodes in DC and DR plus a monitoring node. DC & DR node runs admin, policy service in single node. Currently version 3.2, what's the procedure to upgrade to 3.3 in this scenario. 
Should we upgrade node one-by-one.

[Ben Walters]

There are a number of steps required for an ISE upgrade and it really depends on your node setup.

If you have a look at this guide: https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf 

Starting on page 21 it will go over the process and it has the upgrade order for all different types of deployment, just choose the one that matches your setup and follow that. 

[ahollifield]

What type of deployment is this?  Small medium or large?  It sounds to me like this is not supported deployment.  What roles are on each node?  How many nodes?

[manvik]

@ahollifield it's a small deployment. Each ISE VM has policy, admin node. ISE used only for Tacacs authentication. The tac says upgrade can be done from ISE 3.2 to 3.3.

[ahollifield]

Got it, so only two nodes then?

[manvik]

Yes, two nodes + one for dedicated monitoring (MnT).

[ahollifield]

Huh?  This is not a supported deployment type.  How many nodes total?  Three? 

https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

[Marcelo Morais]

Hi @manvik ,

1st to get the software: ISE Software Download.

2nd check your ISE 3.2 Patch number ... remember that ISE 3.3 has parity with ISE 3.2 Patch 2.

3rd you will upgrade your ISE Cluster first to ISE 3.3 and next to ISE 3.3 Patch 2 (the latest version of ISE 3.3)

4th use the URT (Upgrade Readiness Tool) to validate Config DB upgrade from 3.2 to 3.3 (file ise-urtbundle-3.3.0.430a-1.0.0.SPA.x86_64.tar.gz)

5th you can upgrade via CLI or GUI (check the Cisco ISE Journey for Release 3.3) and choose your upgrade sequence of the Nodes, please take a look at:

Hope this helps !!!

[manvik]

Thank you @Marcelo Morais  and @Ben Walters the TAC says upgrade can directly be done to version 3.3. I am planning to do so.
Most of the ISE upgrade documents were mentioning to detach ISE node from cluster before upgrade, then perform upgrade.
I understand it's not required. If upgrading OS first upgrade secondary ISE VM, then primary. 
If upgrading patch first primary then secondary ISE VM.

[Marcelo Morais]

Hi @manvik ,

 if you "detach" ISE Node (de-register the Secondary Node from Primary), your Small Deployment will become two Standalone Deployment., after that you are able to upgrade one Standalone Deployment to ISE 3.3 Patch 2 and double check if everything is fine before upgrade the other Standalone Deployment.

Hope this helps !!!