ISE Version Upgrade Matrix

[Charlie Moreton]

This will be a short document, but since I have a lot of people asking about the contents, I assume that there are others that could benefit from an easy to read matrix for this.

The question is "If I have ISE version X, can I upgrade to version X.X directly?"

***EDIT: Remember, this is the same matrix to use to know if you can restore a backup from a previous version to a newer.

Cisco ISE Upgrade Matrix

Upgrade From	Latest Version to Directly Upgrade	Patch Required on Original Version		Upgrade To	Minimum Version for Direct Upgrade	Minimum Version for Full Upgrade	Minimum Version for Split Upgrade
1.2*	1.4*	Patch 14		2.0*	1.3*	N/A
1.2.1*	1.4*	Patch 5		2.0.1*	1.3*	N/A
1.3*	2.1*	Patch 8		2.1*	1.3*	N/A
1.4*	2.2*	Patch 12		2.2*	1.4*	N/A
2.0*	2.4*	Patch 8		2.3*	2.0*	N/A
2.0.1*	2.4*	Patch 6		2.4*	2.0*	N/A
2.1*	2.4*	Patch 7		2.6*	2.1*	Patch 10
2.2*	2.7	Patch 14		2.7*	2.2*	Patch 4	2.6 Patch 10
2.3*	2.7*	Patch 6		3.0*	2.4*	Patch 3	2.6 Patch 10
2.4*	3.0*	Patch 8		3.1	2.6*	Patch 10	2.6 Patch 10
2.6*	3.1	Latest		3.2	2.7*	Patch 4	2.7 Patch 4
2.7*	3.2	Latest		3.3	3.0*	Patch3	3.2 Patch 3**
3.0*	3.3	Latest		3.4	3.1
3.1	3.4	Latest
3.2	3.4	Latest
3.3	3.4		*Denotes that the indicated version has reached End of Life
3.4	N/A		**NEW Split Upgrade (Introduced in 3.3)

EoL (End of Life) versions are recommended to be upgraded to a current, supported version.

I kept version 1.2 in the Matrix to show that keeping an older version well beyond its designated End of Life date can lead to complexities in upgrading later on.  In this case, 1.2 would have to be upgraded to 1.4, then to 2.2, to 2.7, then 3.2 and finally 3.3 to get to the latest version of ISE. 1.2.1 would be the same.

As you can see, the supported upgrades go back at least three versions, so if you or one of your customers are close to that threshold, it may be time to plan an upgrade.  Look at the new features offered in the more recent versions, read the ISE Community Page, and make an informed decision about which version is right for you.

ISE has instituted the Suggested Release which is denoted with a gold circle with a star inset to the center .  This shows which version is deemed the most current, stable release.  As of the last edit to this page, the Suggested Release is version 3.3 Patch 2 as shown below.

As with any other software, if a newer release has a feature that you need, by all means, install the newer software.

The information in the tables above can be found here:

Cisco Identity Services Engine Administrator Guides:

cs.co/ise-admin-guides

Cisco Identity Services Engine Release Notes:

cs.co/ise-rn

Cisco Identity Services Engine End of Sale/End of Life Notices:

cs.co/ise-eol

Be sure to check out our YouTube Channel to view the replay of the Upgrading Your ISE Deployment  Webinar that was released with ISE 3.1 and the Cisco ISE New Split Upgrade Webinar for 3.3

[Ping Zhou]

Just to point out 1.4 can go 2.2 directly via ISE CLI.

[Charlie Moreton]

You are right!  Good catch.  I have updated the matrix.

[SergGu]

I'm confused Cisco ISE 3.0 Upgrade Guide: Upgrade Method states the following:

Upgrade From Release 2.4, 2.6 or 2.7 to Release 3.0

You can upgrade all the nodes in a Cisco ISE deployment using the Admin portal from Release 2.0 onwards, you can also upgrade a Limited Availability Release of Cisco ISE 2.0 or later to the General Availability Release.

Your matrix claims 2.6 can only go to 2.7. Can you please clarify?

[Charlie Moreton]

@SergGu,

You are right!  I have updated the matrix and thank you for pointing this out!

[David Mitchell]

Does this apply to the backup and restore method as well?  

** I see this answered in the original post.   Feel free to delete.  

[leanhquy10]

I have cisco ise cluster with 4 node (1 ppan, 1span, 2 psn) version 3.0 patch 4. 

Can I upgrade direct to cisco ise version 3.3?

[arjahang]

What is the minimum patch required on 2.4 to upgrade ISE 3.0?