ISE upgrade QUESTION

[N3om]

Hi
I have been tasked with upgrading our distributed ISE deployment running version 3.3 up to version 3.4 for the new workload connectors feature

My question is, if I upgrade using the cli method then do i need to regenerate the Root CA has the old SEC PAN will become the new PRI PAN in the 3.4 deployment and I will want to promote the old 3.3 PRI PAN back to 3.4 PRI PAN ??? see below 
Thanks

Root CA chain regeneration

If any of these events occur, you must regenerate the root CA chain

Change the domain name or hostname of your Primary Administration Node (PAN) or PSN.

Restore a backup on a new deployment.

Promote the old primary PAN to a new primary PAN after an upgrade.

[Arne Bier]

Hi @N3om 

The first node to be upgraded is the old 3.3SPAN - it becomes the new 3.4PPAN - when you have upgraded the last 3.3 node (old 3.3 PPAN) you will be done with the upgrade - but as you said, you want the current new SPAN to be promoted back to PPAN. Once that is done, you might take a look at the ISE Alarms and most likely see Queue Link Errors. This is common and expected (and I have never found out why Cisco has done this - it's annoying). It appears to be related to the ISE Secure Messaging feature that transports the ISE syslog events in TLS - but upgrade break that mechanism.  To fix the Queue Link Errors, the only solution I have found is to regenerate the ISE Root CA. If you had already generated any certs in previous 3.3 ISE with the ISE Root CA then you need to pay attention - because all new ISE certs you generate with the internal CA will have a new PKI structure.  

The key thing is to only regen the ISE Root CA when the upgrade is complete. It doesn't matter which node is the current PPAN but you should have all nodes on the same version. If you promote a node in your day to day operations, you should not get any CA related alarms.

[N3om]

@Arne Bier So are the queue link errors disruptive to normal clients in anyway or just between the ISE nodes? and how disruptive is regen of ISE ROOT CA ??

Thanks

[Marcelo Morais]

Hi @N3om ,

 beyond @Arne Bier already said ... for more information about Queue Link Error, please take a look at: ISE - Queue Link Error.

Hope this helps !