ISE External backup sizing

[ammahend]

we are trying to create an SFTP server for ISE config and operational backup for 25k user in a 6 node distributed deployment with 15 days scheduled backup, version 2.4 patch 5, any recommendation on backupserver sizing (cpu,ram.disk etc) ?

also any new update on CSCva23881

[Damien Miller]

The cpu and ram of the backup server doesn't matter much, I've used very low power notebooks in the past when in a bind. The larger consideration will be the number of days you want to keep your backups for and how many revision you want. This will define the backup repository disk size. Keep in mind that ISE does not have any clean up job in regards to the backup repository so you will have to build a script for that. If it's a linux server, cron job, and if it's on windows, then task manager can be used to run it.

Backup sizes are quite deployment dependent, I've had anything from 70 MB, to 12 GB. To be fair the larger ones were on older versions that contained logging that shouldn't have really been backed up to begin with. I believe that has since been resolved. If it's an operational deployment, take a few sample backups, use the size to estimate the required disk. The ISE admin guide still recommends the backup repo have 10 GB for small deployments, 100 GB for medium, and 200 GB for large.

Incremental backups have not been introduced, the enhancement request is still just that, full backups only.

[ammahend]

Thanks for the quick reply, we want to keep the backup for a month, which I believe is max in ISE anyways. I was sizing close to 500 gig, so that should be good enough to keep at least 2 backup versions or more

[Damien Miller · Accepted solution]

500 GB is way more space than you need for ftp backups, it's likely that each of your backup files will be under 2 GB. I will also note that ISE does not keep track of past backups file ages, and it does not care if you backup file is older than 30 days. You set a schedule for ISE to run backups such as every week on friday night, or daily at 2 am, and it will run and export the tar.gz backup file. It will be the responsibility of the backup server to maintain and remove the old backup files. If you only want to keep 2 back up files, you need to write a script to clean up the ftp folder. ISE will not perform any clean up of your repository, it only creates backups files, or reads them to restore, it never deletes a backup file.

The backup file contains the ISE admin node config, so they are relatively compact. If you ever have to restore it, you deploy a VM from an OVA or ISO and point the ISE node to the ftp repository to select a restore file. It's important to backup the certificate store separately because this is not part of the scheduled backup file you get.

[ammahend]

Thanks, yes I have taken manual certificate backup already.