ISE upgrade re-image

[siddhesh.parab@orange.com1]

Hello Team,

Need your suggestions.

we have 12 ISE nodes installed on VM and need to perform below task

1. To chnage HDD of admin & MnT node only.

2. need to upgrade all nodes on new ISE version. 

Reigon-1 --- 6 nodes

+++++++++++++++++++

1. Primary Admin

2. Secondary Admin

3. Primary MnT

4. Secondary MnT

5. PSN

6. PSN

Reigon-2 ----2 nodes (Similary we have additional 4 PSN in two different region)

1. PSN

2. PSN

Could you please suggest sequence of nodes ?? How to proceed.

My understanding is ----

1. first deregister Admin-02, create new VM, chnage HDD, install new image, restore config backup, chnage role to primary.

2. Deregister MnT-02, Create new VM, chnage HDD, install new image, chnage role to primary.add in new deployment 

3. Deregister any PSN on which we have less traffic, upgrade it to new version , add in new deployment.

4. similarly do for all pending 7 PSN.

5. Deregister MnT-01, Create new VM, chnage HDD, install new image, chnage role to secondary.add in new deployment. 

6.Deregister Admin-01, Create new VM, chnage HDD, install new image, restore config backup, chnage role to Secondary.

7. finally chnage role as per old deployment 

[Arne Bier]

That sounds like a good sequence to me. Perhaps add a step in after doing the first PSN to ensure that all is working well with as many use cases as possible. Don’t forget to patch (either at the end in a Big Bang approach, or one by one. If you patch the new Primary admin, then all subsequent nodes need to be on same patch level before you can register them into the cluster). 

[Damien Miller]

You could possibly save time changing the HDD of the admin and MNT after the upgrade.

If you were to upgrade admin-02 first using the inline method, running the upgrade bundle, then any subsequent nodes would join it without having to deregister, and register manually. You would only have to run the upgrade bundle on them and they would join on their own. When you are done with all the nodes, you could then rebuild the 4 PAN/MNT nodes without much impact.

If you follow you steps, then item "6." is not required, you do not have to restore the configuration backup, you only have to join it to the deployment.

Another option could be to rebuild the 4x PAN/MNT before you upgrade, then inline upgrade them. The options are limitless.


How ever you do it though, I agree with Arne, pause for testing once you have one PAN, one MNT, and one PSN upgraded. This would be the best point to role back or catch anything before going too far.