ISE Deployment patching

[N3om]

Hi

Six node distributed ISE Deployment

Whats the recommended order to patch fronm cli please.??

1.PRI-PAN which is also SEC MNT

2.SEC-PAN which is also PRI MNT

3.PSNs

[Arne Bier · Accepted solution]

Always Primary PAN first. Then the next PAN, PSNs last. I can't remember seeing a documented technical reason why this order is good/necessary. I think it's possibly just common sense because the primary database is on the Primary Admin node and since it's in charge of writing to the database, it gets patched first.  The operational benefit of doing PAN first, is that you "take the hit" of taking down the admin GUI first, and then you can monitor the rest of the patching process from the GUI.

[adamscottmaster2013]

---

@Arne Bier wrote:

Always Primary PAN first. Then the next PAN, PSNs last. I can't remember seeing a documented technical reason why this order is good/necessary. I think it's possibly just common sense because the primary database is on the Primary Admin node and since it's in charge of writing to the database, it gets patched first.  The operational benefit of doing PAN first, is that you "take the hit" of taking down the admin GUI first, and then you can monitor the rest of the patching process from the GUI.

---

Hi @Arne Bier:  The poster asked about patching via the CLI.  I just did one recently, and according to Cisco TAC, it should be in this order:

1- PAN

2- PSNs

3- SAN

[Arne Bier]

At least we agree on PPAN first. I think the order I described is the same as what ISE developers chose when you patch via the GUI. I think that TAC has a more efficient method because you can test the patch on PSN a bit sooner. But apart from that it’s horses for courses.

[balaji.bandi · Accepted solution]

check some guidance :

https://www.youtube.com/watch?v=qV5-KY0CCQo&t=177s

Post :

https://community.cisco.com/t5/network-access-control/patch-upgrade-in-cisco-ise-distributed-deployment/m-p/5287196