migration of appliances to VM + upgrade

[nkeuparl]

Hi there, i am planning to migrate PAN/SAN and 2 PSN running ISE 2.4 on old 3315 appliances to PAN/SAN 2PSN 2MNT running ISE 3.2 on virtual machines

is there a guide/ or many / that i could rely on ? ( migrate appliance to vm / maybe running vm+on prem at same time if possible / implementing MNT / migration path from 2.4 to 3.2 )

is it possible to integrate the new vm components in the old infra and disengage the appliances slowly then? 

is it possible to run at the same time diffrent versions ?

how does it work for the certificates and for the licenses ? 

any recommendations?

Thank you!

[marce1000]

    - In my opinion this will be difficult because of the huge leap in versions  ; what I would do is start building the ISE VM based environment manually from scratch (including entering the policies and final testing). 
     Lots of trouble could be avoided   and or 'sudden showstoppers' on the way.  And you have 'free time' for testing
     on the new environment without hurting business (e.g.)
    What I  used to do is  simply switch radius servers  on the NAD's when a new ISE deployment was ready for use.

 M.

[Marcelo Morais]

Hi @nkeuparl ,

remember that:

1st ISE 3.2 supports restore from backups obtained from ISE 2.7+

2nd ISE 2.7 supports restore from backups obtained from ISE 2.2+

3rd a VM Common License (VMC) is a MUST when you use VMs

4th if you own Traditional Cisco ISE Licenses, you MUST convert them to Smart Licenses

5th for TACACS+, you MUST have Device Administration License for each of the PSN that you enable TACACS+ Service.

6th take a look at the new license model at Cisco ISE Licensing Guide, check for Figure 8: EA Conversion of 2.x licenses to 3.x subscription licenses.

My recommendation:

1st generate a backup from ISE 2.4

2nd create an ISE 2.7 from scratch on a new VM

3rd restore the ISE 2.4 backup on the new ISE 2.7

4th create a backup from the new ISE 2.7

5th reinstall the new ISE 2.7 from scratch with a the ISE 3.2 P6 version

6th restore the new ISE 2.7 backup on the ISE 3.2 P6

7th test your ISE 3.2 P6

at this point, you have an ISE 2.4 Cluster and a ISE 3.2 P6 Standalone and you can choose the best time to create the others VMs for your ISE 3.2 P6.

Hope this helps !!!