ISE upgrade procedure

1. ISE 2.1 to 2.3 없그레이드 절차
1. backup하기위해서, admin->certification->CA->internal CA setting에서 enable ceritficate authrity 하고
1. upgrade절차에 있는 configuration backup 하기.

b. 현재 ISE에 repository 가 없으므로, 새로 만들기.. Disk로 지정...

1. management 망에 PC연결하여 FTP서버 실행
2. ISE에서 repository 를 FTP 서버로 지정하여 만듬
3. Upgrade 메뉴로 이동. FTP 서버 통해, ISE에서 OS 다운받음.
4. upgrade sequence는 secondary PAN가 먼저, 그다음 node는 임의로 선택가능.
1. 수동으로 upgrade가아니라, node가 끝나면 자동으로 넘어감.
5. node당 4시간 정도 소요

1. deployment 구성
1. DNS 등록

configure the Domain Name System(DNS) server. Enter the IP addresses and fully qulified domain names(FQDNs) of all the Cisco ISE nodes that are part of your distributed deployment in the DNS server. Otherwise, node registration will fail.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011.pdf

ISE의 FQDN과 IP address를 추가.

2. Secondary ISE에서 CA 인증서 생성 및 export
3. CA 인증서를 Primary ISE에 import 및 secondary ISE를 register등록
4. ISE 2.3버전 replication 및 cluster 필요한 port

 

HTTPS (SOAP): TCP/443

Data synchronization/ Replication (JGroups): TCP/12001 (Global)

Clustering (Node Group) : Node Groups/JGroups: TCP/7800

CA PKI :  TCP/9090

Device Administration  : TACACS+: TCP/49

Cisco ISE Service	Ports on Gigabit Ethernet 0 or Bond 0	Ports on other Ethernet Interfaces, or Bond 1 and Bond 2
Administration	-HTTP:TCP/80, HTTPS:TCP/443 -SSH server:TCP/22 -OCSP:TCP/2560	Cisco ISE management is restricted to Gigabit Ethernet 0.
Replication and Synchronization	-HTTPS(SOAP):TCP/443 -Data Synchronization / Replication (JGroups):TCP/12001(Grobal)	-
Clustering(Node Group)	Node Groups/JGroups:TCP/7800	-
CA PKI	TCP/9090	-
IPSec/ISAKMP	UDP/500	-
Device Administration	TACACS+:TCP/49 Note  This port is configurable in Release 2.1 and later releases.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/install_guide/b_ise_InstallationGuide23/b_ise_InstallationGuide23_chapter_0110.html

1. deployment upgrade 시 소요시간
1. https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/upgrade_guide/b_ise_upgrade_guide_21/b_ise_upgrade_guide_21_chapter_00.html#reference_B620AA67DB594580B28983A4AFE8C620