Hello, Today I would like to share the way to downgrade Cisco ISE version from 2.4 to 2.2. I know all of you want to ask the prior question of why we go to downgrade? The customer asks for High availability, the customer has SNS 3515 version 2.4, SNS 3415 Version 2.2, As we know there are some prerequisites for Cisco ISE and the Key prerequisite should be the same Version and some others like DNS, NTP ETC. Secure network server model number 3415 IS not support for 2.4 and it has existing version 2.2. Secure network server model number 3515 IS support for 2.x till the last version and it has existing version 2.4. So we going to make downgrade for SNS 3515 from 2.4 to 2.2, First thing we need to proceed, Download the same Image from Cisco Software downloader. Formate HD from CIMC through KVM. Connect the laptop directly to the SNS and make reachability between Laptop and SNS as local. Open Cimc, Choose Lunch KVM. From KVM- Console chooses Virtual media and define Map [ removable hard disk ] from the list. NOTE: you can choose the CD/DVD, I had connected the Removable Hard disk to my laptop so I go with this choice. choose the image which downloads from Cisco software tools, Press run. choose ISE Bootstrap [ Cisco Ise installation Keyboard/Monitor], [ Cisco SE installation serial console ]. It will take a long time for installing the image Specialist for Oracle Package 1-2-4, Iware 135 firmware, 14965 firmware so don’t worry. After finish (511/511) package installation so will ask for login press Enter Enter the Network configuration include IP address, Subnet mask, Default gateway, DNS primary & secondary, Etc… Now you can access through GUI and Join the ISE with Domain and Add the id address as Record on DNS. Get the FQN from administration icon choose the deployment. go to the node which will be as primary and press register and past the FQN which you get from the second node. Will search with DNS and get success. -Now you can go with your scenario which you want for HA, If one node will be PSN+MGT or admin + monitor policy service or pxgrid. ... View more

Let's take today about the stateful Nat [ SNAT] -This is Feature give us translation more than one network address which mean Back up nat to the active failure.  - Nat is great feature help us to permit the interconnection of private network to reach the Public network. - SNAT work as active and back up scenario the active handle the traffic require translation ip address from Private to public. - Back up SNAT is working as duplication all the translation which in the active table and once the active translator is down the back up will handle the translation and will replay to all requests.  - There is Two phases of the SNAT , phase one was  not supported for the application level,  Phase two is provide the application level and asymmetric routing [ Encryption method use two Keys to encrypt the plain text secret key is change over the internet] recommend to read one fully article about the asymmetric & symmetric. -The mapping-id must be the same between them -Redundancy string must match the standby name.   Example for the SNAT configuration :  -------------------------------- Interface Gig 0/0/0 Description SNAT Standby 10 name SNAT-DC standby 10 ip address 10.100.101.254 ip nat inside  -----  interface Gig 0/0/1 Ip nat outside  ---- IP nat stateful id 10 redundancy SNAT-DC Mapping-id 90 ---------------------------- access-list nat  10 permit 10.100.101.0 0.0.0.255  Ip nat pool SNAT-POOL 37.0.0.100 37.0.0.100 prefix-length 24  Ip nat inside source list nat pool  SNAT-POOL mapping-id 90 overload  --------- router bgp 6508 bgp router-id 10.10.10.10 no  bgp default    ipv4-unicast neighbor 38.0.0.100 remote-as 6509 address-family ipv4 network 37.0.0.100 mask 255.255.255.0 exit ------------ some of commands help for T-shoot  Show ip snat peer  show ip snat distributeed   show ip snat distributed verbose   show standby   ... View more