ISE Small Deployment upgrade

[Chess Norris]

Hello,

I'm planning for upgrading a Small Deployment ISE setup with just a primary and secondary node.

The upgrade will be from ISE 2.7 to 3.2. 

After upgrading the secondary node, do I need to de-register the node from the cluster, or should I turn off failover and promote the secondary node to primary? 

Also, what is the best way to deal with the license transfeer from the old 2.x licenses? Should I prepare to get the new licenses in my smart account before the upgrade or should I ask Cisco to migrate the licenses after the upgrade?

Thanks

/Chess

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/upgrade_guide/Upgrade_Journey/PDF/b_ise_upgrade_guide_3_2_pdf.pdf

 M.

[Chess Norris]

Thanks for the reply. 

I am a bit confused about the "application upgrade prepare" command. According to the upgrade guide, this command will copy the ISE image from the remote repo to the local repo I already created, but when I do a "show <local repo>, I just see some log files there, but no image.

Same if I do dir disk  

I saw an older upgrade instructions where it says

For upgrade, you can copy the upgrade bundle to the Cisco ISE node's local disk using the following command:
copy repository_url/path/ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz disk:/
For example, if you want to use SFTP to copy the upgrade bundle, you can do the following:

1. (Add the host key if it does not exist) crypto host_key add host mySftpserver
2. copy sftp://aaa.bbb.ccc.ddd/ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz disk:/
3.  aaa.bbb.ccc.ddd is the IP address or hostname of the SFTP server and ise-upgradebundle-2.x-to-2.7.0.xxx.SPA.x86_64.tar.gz is the name of the upgrade bundle."

Should I use the copy command or is the "application upgrade prepare" enough to copy the ISE upgrade bundle to the local repo?

Also how about patching? Should I promote the secondary node to primary after I patch it?

Thanks

/Chess

[ahollifield · Accepted solution]

The prepare is enough.  In both scenarios the upgrade bundle is copied to the local machine.   Don't forget to the run the URT on the secondary admin node.

Patching no, you patch the PAN first. 

[Chess Norris]

Thank you for the confirmation.

/Chess

[ahollifield]

https://community.cisco.com/t5/security-knowledge-base/ise-version-upgrade-matrix/ta-p/3653501

Yes you should open a licensing TAC case to migrate your 2.X licenses to 3.X smart licenses.