Solved: Re: ISE upgrade

torstensson · ‎11-24-2021

Hi all,

I'm planning on upgrading four ISE servers in a cluster from 2.4 to 2.7 that are running on VMs. Is it possible to upgrade it by removing a node and then installing a new one with the new version to then add one by one replacing the ones with the old version? So remove one of the four, adding a new ISE server to the cluster with the new version and keep at it until all four is replaced.

On physical appliances I would just upgrade one by one through the GUI after doing the backups but considering that it's on VMs in this case it would perhaps be faster to replace them.

Br

Lars

Arne Bier · ‎11-25-2021

Hello @torstensson

yes - your approach is very commonly implemented - it's called the config-restore upgrade. Assuming you want to keep the same IPs for all or some of the nodes (PSN's in particular) then you would take a ISE 2.4 config backup, and then shutdown PAN/MNT_1, and run the setup on a ISE 2.7 VM with the same IP details. Restore the config on that node and do all the usual cert stuff and make node Primary. Then shutdown PSN1 and prep the new PSN1 VM with the necessary setup to allow it to be registered to PAN/MNT_1. Rinse and repeat with the rest.

Of course, if you have two PAN/MNT and two PSN's, and if you don't mind giving the PAN/MNT new IP addresses, then you can build the PAN/MNT nodes in your own spare time - and only shut down the PSNs one-by-one during a planned maintenance window (re-using their IP addresses for the setup wizard).

regards

View solution in original post

Arne Bier · ‎11-25-2021

Hello @torstensson

yes - your approach is very commonly implemented - it's called the config-restore upgrade. Assuming you want to keep the same IPs for all or some of the nodes (PSN's in particular) then you would take a ISE 2.4 config backup, and then shutdown PAN/MNT_1, and run the setup on a ISE 2.7 VM with the same IP details. Restore the config on that node and do all the usual cert stuff and make node Primary. Then shutdown PSN1 and prep the new PSN1 VM with the necessary setup to allow it to be registered to PAN/MNT_1. Rinse and repeat with the rest.

Of course, if you have two PAN/MNT and two PSN's, and if you don't mind giving the PAN/MNT new IP addresses, then you can build the PAN/MNT nodes in your own spare time - and only shut down the PSNs one-by-one during a planned maintenance window (re-using their IP addresses for the setup wizard).

regards