Solved: Re: ISE deployment - different versions for migration

stephan.ochs · ‎10-23-2023

Next year we need to migrate our deployment (2 ISE 2.7 on SNS-3515) to new hardware and newest version.
My plan is to install new hardware, add it to the existing deployment and remove the old ones.

I was searching for some information about compatibility between ISE versions within a deployment, but didn't find anything.

I am nearly sure 2.7 won't be possible with 3.3.
The maximum version for SNS-3515 is 3.0.
So would it be possible to update our existing ISE deployment to 3.0, add new ISE with 3.3 and then remove the 3.0?

Dustin Anderson · ‎10-23-2023

Best is to restore a backup to the new appliance on the new code. Test it with a demo VM to make sure, but we did this going for 3595s to 3765s 2-node deployments. We basically shut the primary down, brought the new one up on the new code/patch and restored the backup. Then did the secondary and joined it to the first in HA. We went from 2.6 to 3.1 this way without issues.

View solution in original post

marce1000 · ‎10-23-2023

- You may find this document useful : https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_3_pdf.pdf

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

stephan.ochs · ‎10-23-2023

Yes, this document is useful for upgrading, but not for my question.
I can find upgrade paths here, but my essential question is:
Is it possible to have a deployment with "mixed" Versions: ISE 2.7 and ISE 3.3 or ISE 3.0 and ISE 3.3.

marce1000 · ‎10-23-2023

- It isn't ,

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

stephan.ochs · ‎10-23-2023

It isn't for 2.7/3.3?
For 3.0/3.3 it should be possible.
When upgrading a deployment from 3.0 to 3.3 (possible as written in upgrade guide) there's the situation, that I have some 3.0 and 3.3 mixed in the deployment.
Right?

Marvin Rhoads · ‎10-23-2023

ALL nodes in a given ISE deployment must be the same major and minor release. This applies for all versions of ISE ever.

Patch versions can vary, but it's not recommended to run that way for an extended period - only during deployment of patches to the next level,

Dustin Anderson · ‎10-23-2023

Best is to restore a backup to the new appliance on the new code. Test it with a demo VM to make sure, but we did this going for 3595s to 3765s 2-node deployments. We basically shut the primary down, brought the new one up on the new code/patch and restored the backup. Then did the secondary and joined it to the first in HA. We went from 2.6 to 3.1 this way without issues.

stephan.ochs · ‎10-23-2023

Thank you for your help. I was hoping there was a way to do a soft migration. We will probably do it via backup/restore.