Promote primary PAN to secondary and Vice-versa

[Pat Pouna]

Team, below is my current deployment:

ISE1 : Admin and MnT personas SEC(A), PRI(M)

ISE2 : Admin and MnT personas PRI(A), SEC(M)

2 PSNs.

In preparation of ISE upgrade from 2.3 to 2.7, I would like to promote ISE1 primary, ISE2 Secondary in order to start the upgrade with ISE2. 

I know that promoting the secondary PAN to be the primary involves a whole synch between the two nodes +  the application services on both nodes are going to be restarted.

My question is, should I promote the SEC to PRI first, and then change the old PRI to SEC? Is there an order of operation to respect or it does not matter? 

[Damien Miller · Accepted solution]

You will log in to the current secondary admin node and click "promote to primary", it will also demote the current primary to secondary. There is no additional interaction you need, ISE takes care of the moving the primary role and demoting the existing primary. The only thing you need to plan for is the application services and node reloads, and the associated change window for the outage. 

If you wish to move the monitoring node primary/sec, you can do that anytime without end user impact but there is no need to move if unless you want.

 

[Pawan Harle]

many Thanks for this post

[Pat Pouna]

Sounds Good Damien Thanks ! 

[Nadav]

Initially ISE2 is primary and ISE1 is secondary. Keep in mind that the active PAN is always the first one to be upgraded if you're upgrading via GUI. 

So this statement:

In preparation of ISE upgrade from 2.3 to 2.7, I would like to promote ISE1 primary, ISE2 Secondary in order to start the upgrade with ISE2. 

Is incorrect since promoting ISE1 to primary means the upgrade would start with ISE1. 

If you want full control of your upgrade workflow, you can use CLI and a repository.