Migration/upgrade path ise 2.0 on 34xx to 2.6 on 36xx

[gvanbon]

Hi,

Customer needs to migrate/upgrade from an ISE 2.0 deployment on 34xx to a new ISE 2.6 deployment on 36xx.

What is the best way to do this ?

Upgrading on the old hardware does not seem to be an option as 2.6 can only run on 36xx.

Also restoring from 2.0 to 2.6 does not seem te be an option.

Any advise ?

Thanks!

[Greg Gibbs · Accepted solution]

There are typically 2 options for this scenario:

1. Do a new build of 2.6 on the 36xx appliances in parallel and manually configure to match the current policy requirements. When ready, cutover to the new cluster (ideally changing the LB pool so you don't have to repoint the NADs).
   • This option would allow you to clean up any old configuration and rebuild the policies to suit the new Policy Set structure used by ISE 2.3+ versions. It would also provide the ability to cut back over to the old cluster in case of any issues.
2. Stand up a temporary ISE VM. Restore the current 2.0 config to the VM, do a 2-step upgrade to 2.6, backup the configuration, and restore it to the 36xx.
   • Two-step upgrades can be troublesome with some features, so this should be tested extensively in a Non-Prod environment first. There will also likely be some policy cleanup needed after the migration to the new Policy Set structure (to reduce duplicated Policy Sets).
   • Be sure to follow the Pre- and Post-upgrade steps for ISE 2.6 as well as the interim OS version (2.1+) as well - https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/upgrade_guide/b_ise_upgrade_guide_26/b_ise_upgrade_guide_26_chapter_01.html

Cheers,

Greg

[gvanbon]

thanks