Hello,
- Should first I register all new nodes on the primary PAN and then restore the backup configuration or first should I import the backup and then register the nodes?
First import the backup on a new standalone PAN. Make it Primary after the restore. Install Admin cert and then register the other standalone nodes (those should have Admin certs too)
- Should I need to integrate again with Active directory after import the backup?
Definitely. ISE does not automatically join the AD after a restore. I find one of the best methods is to create an AD Service Account just for ISE, with limited privileges, that the AD Team can provide to you. Then you can do this AD Join without their assistance.
- Since the new VM will have a different IP address and hostname, can I still use the backup from ISE with a different IP and hostname? I saw that in this case, I should not select option include-adeos
Yes. The IP address details in the ISE backup only relate to the PAN on which it was backed up. When restoring, don't select the include-adeos option.
- How can I migrate/still use the same licenses from the previous VM
Smart Licensing works as usual - point new ISE Deployment to Smart and register it. Don't worry if you don't have double as many VM licenses - you will get a warning - ignore it. Once you are ready to destroy the Azure deployment, your license count will reduce and you'll only consume VM licenses for on-prem nodes.
- I can export and import the trusted certificates via
If the FQDNs of the new on-prem nodes are the same as the FQDNs of the Azure nodes, then yes - export them somewhere safe, and then import them into the on-prem nodes one-by-one. But I doubt this will be viable, if you want to run things in parallel - I don't know how you will achieve the same FQDN for two different IP addresses.
- I can keep both setups in parallel, correct?
Yes, you can, but you will have to deploy the on-prem nodes with different IP addresses to the Azure Nodes. Unless you have some clever tricks to allow the IP addresses of the Azure ISE nodes to also work on-prem, all at the same time. I am not too clued up on how public cloud works, but something tells me, this would be ugly, if not, impossible. Unless you're using IPv6 in the cloud. I doubt it though ...
Changing your PAN and MNT IP addresses to new addresses is no big deal. The impact is when you have new PSN ip addresses. This means you must change the NAS/NAD configs to point to the new PSN IPs. Perhaps not a bad idea, because it could be your smooth migration strategy. Move one or a few NAD devices at a time to the new deployment.
Yes. Think about your migration strategy too.
