ISE Upgrade Query

[benolyndav]

HI

i have downloaded the the 3.3 upgrade bundle to our ISE Nodes, When I select the Sec PAN to be upgraded its stating 480 mins is this accerate, We are upgrading from 3. to 3.3

Also I have ran the purge from the gui fro data older than 30 days,  Also is it possible to upgrade using cli now I have used the gui to download the bundle to the nodes?  If so would upgrade using cli method be quicker ?

Thanks

[Rob Ingram]

@benolyndav refer to the following Cisco guide - https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2889.pdf which provides a break down of the upgrade methods. CLI still takes a long time compared to the GUI upgrade, but is considered more complex and more work.

https://www.youtube.com/watch?v=D7poFnsd-8U&pp=ygULaXNlIHVwZ3JhZGU%3D

https://www.youtube.com/watch?v=q2JpC8oNssA&pp=ygULaXNlIHVwZ3JhZGU%3D

[benolyndav]

@Rob Ingram 
Yes I have watced these and had forgot about the cli method being long, I am thinking the upgrade hasnt got a chance of being succesful due to the 4 hour upgrade process time limit, any thoughts please, is the 480 just an approx figure or is it accurate ?

Thanks

[Rob Ingram]

@benolyndav the last upgrade I performed (3.1 > 3.2) was quicker than the URT stated. How big is your database? What hardware are you using (physical or VM)?

What about using the Backup and Restore method?

Have you purged operational data, inactive endpoints and guest accounts?

[benolyndav]

@Rob Ingram 

VMs for hardware

M&T primary =47GB

M&T standby =39GB
We have 30000 inactive endpoints, I cant find how to purge these any idea please.?

Thanks

[Rob Ingram]

@benolyndav navigate to Administration > Identity Management > Settings > Endpoint Purge and create/modify the purge rule.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_maintain_monitor.html#concept_0776B37A2C3542189950F5DFB1961FA2

You can purge the operational data as below.

[benolyndav]

@Rob Ingram 

I have already ran this one, I will have a look at the endpoints purge 

[benolyndav]

@Rob Ingram 
In the maintenance tab what does( purge all data)  do,  I have purged data older than 20 days for now, Is it worth even attempting the upgrade if its stating estimate  480 mins for the PANS?  could I expect the upgrades to be completed within the 4 hour threshold ??

[Rob Ingram]

@benolyndav 

Operational Data Purging

Cisco ISE Monitoring Operational database contains information that is generated as Cisco ISE reports. Recent Cisco ISE (Cisco ISE Release 2.4 and above) releases have options to purge the monitoring operational data and reset the monitoring database when the application configure ise command is run.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_deployment.html#id_39776

This data can be purged as long as you don't not wish to run historical reports.

Can you re-run the URT after the data purge, what is the estimate now? The duration estimate is subject to environment specifics, 480 does seems excessive compared to the last upgrade I performed.

[benolyndav]

@Rob Ingram 

Is it ok to run urt again now i have downloaded upgrade bundle to all nodes.?

Thanks

[Rob Ingram]

@benolyndav yes, ok to re-run the URT, just make sure no changes are being made nor backup taking place when the URT is run.

[benolyndav]

@Rob Ingram 

actually just noticed that urt says 2 hours less than gui, still seems to be lot of MnT?

Time estimate for upgrade

=========================

(Estimates are calculated based on size of config and mnt data only. Network latency between PAN and other nodes is not considered in calculating estimates)

Estimated time for each node (in mins):

MNT data is 58 GB, purging this data can reduce upgrade time

MAD-ISE-01(SECONDARY PAP,MNT):365

MNT data is 58 GB, purging this data can reduce upgrade time

CAM-ISE-01(PRIMARY PAP,MNT):360

MNT data is 58 GB, purging this data can reduce upgrade time

Each PSN(5 if in parallel):65

mnt.analytics.storage already exists in platform.properties

mnt.analytics.storage already exists in platform.properties-active

Final cleanup before exiting...

Application successfully installed

[Rob Ingram]

@benolyndav either purge more data to reduce upgrade time or use the backup/restore method.

[benolyndav]

@Rob Ingram 
Do I need a different version of putty to ssh onto 3.3 i input credentials then the window opens and instantly shuts ??

[Rob Ingram]

@benolyndav I cannot say I've had a problem, I use the latest version of putty (0.81) without issue. Can you connect to the VM console of the node and confirm it is actually up?