Upgrade ISE from 1.2.1 to 1.4

[erichusidley]

At what steps, user will not be able to authenticate and authorize with Cisco ISE,

(1) Upgrade secondary Administration Node

(2) Upgrade primary Monitoring Node

(3) Should I upgrade both Policy Nodes at same time or one Policy Node at a time?

I like to eliminate any outages during the ISE upgrade.

(4) Upgrade secondary Monitoring Node

(5) Upgrade Primary Administration Node.  It will become secondary Administration Node in new deployment.

After all nodes are upgraded, Should I promote new secondary Administration Node back t Primary Administration Node?

Thanks,

[ajc]

The Authentication process only happens on the PSN Nodes. You need at least patch 5 on 1.2.1 version before installing the application upgrade bundle.

Yes you need to promote the new secondary PAN to primary.

[Octavian Szolga]

Hi,

If all your NADs are configured with both or all ISE PSN's you won't have any downtime...

The downtime is your radius timeout settings. (how much it takes for NAD to detect that the first PSN is down)

Thanks,

Octavian

[ajc]

that is correct, the downtime would depend on the radius settings configured but also for wireless environment on the fallback configuration of the wlc. For WebAuth, I have seen issues when you have multiple entries for AAA servers on the WLC/SSID and round robin dns is being used.