ISE Upgrade (Hw & Sw)

[Alvaro Luiz Maia Motta]

Hello folks, greetings.

Our customer has a pair of ISE 2.2 (PRI(PAN, PSN & MnT) and SEC(PAN, PSN & MnT)) running on old hardware and they have purchased a pair of new UCSs to migrate the deployment. Besides the hardware migration, they want to upgrade the deployment to version 2.7 as well.

We have seen a ton of documentation, but could not find any that would involve hardware upgrade along with the ISE upgrade.

We are considering the following strategy:
1 - Upgrade the current environment to version 2.7
2 - Install a fresh copy of version 2.7 on the new hardware
3 - Add both nodes to the existing deployment
4 - Remove the old nodes.

Is it feasible? Would the final deployment be clean of version 2.2 traces? Any better recommendation?
Should the outlined strategy be more secure and straightforward, what would be the precautions we would have to take in regards to certificate and how can we transfer the licenses of the current nodes to the new ones?

We'd appreciate any help.

Thanks in advance,

AL

[Marcelo Morais · Accepted solution]

Hi @Alvaro Luiz Maia Motta ,

 yes, it's a good Action Plan.

 Remember that at the end of the day the Serial Number (check it at Administration > System > Licensing - check the UDI Details) of the ISE Cube will be the new PAN Serial Number.

Note 1: remember that ISE 2.7 supports restore from backups obtained from Release 2.2 and later, in other words, you are able to install a fresh copy of 2.7 on the new hardware and restore the backups.

Note 2: ISE 2.7 P6 is a good patch.

Hope this helps !!!

[Alvaro Luiz Maia Motta]

Hi Marcelo, greetings!

Thanks for your reply. Apparently the restore 2.2 on top of a clean 2.7 would be the best option.

Any difference in upgrading the 2.2 to the latest patch (17) before backing up?

Once again, thanks a zillion!

BR,

AL

[Marvin Rhoads]

If they purchased just UCS servers (and not SNS-36x5 ISE servers) then they cannot install ISE directly onto the bare metal servers - they must first install ESXi and then run ISE as a VM. If running as a VM then VM licenses are required.

As far as version, 3.0 patch 4 is currently recommended as Gold Star.

[Alvaro Luiz Maia Motta]

Hi Marvin, greetings!!

Thank God they have purchased the ESXi and ISE VM licenses.

Thanks and have a great week!

AL

[Peter Koltl]

The simplest way is to fresh install 3.0 on the new hardware, then restore the configuration from 2.x backup. Even IP addresses and hostnames can be identical if you can provide an isolated environment.

[Alvaro Luiz Maia Motta]

Hi Peter, greetings.

For some reason, they cannot go to 3.x now. Apparently they need to do some upgrade before. We'll investigate on the requirements and maybe there is no need to have 2.7 temporarily.

Thanks,

AL

[Marcelo Morais]

Hi @Alvaro Luiz Maia Motta ,

 two notes:

1. ISE 3.0: supports restore from backups obtained from Release 2.4 and later.

2. "Any difference in upgrading the 2.2 to the latest patch (17) before backing up?"

ISE 2.7.0 parity with ISE 2.2 P15, 2.3 P7 and 2.4 P10 and 2.6 P2 ... IMO, if my ISE is 2.2 P15 or later, then I'm good to backup and restore without problems, if not, then I always prefer to update before backing up (this is what I do) !!!

Hope this helps !!!

[Alvaro Luiz Maia Motta]

Hi Marcelo,

Since they have 2.2 P16, I guess we're good to go from there.

Thank you very much for helping us to save a few hours.

BR,

AL