upgrade ISE in AWS

[bgoulet00]

knowing this is a replace rather than upgrade my plan to to build a whole new cluster in parallel and use backup/restore to migrate the configuration to the new cluster.  the new cluster will have all different hostnames and IPs so how do the clients access the new system?

my thought is to create a cname that points to the old PSNs and configure all devices to point to the cname for radius and tacacs services.  when it is time to migrate over to the new cluster just repoint the cnames.  my concern is i don't know if the network devices perform dns caching which would keep them going to the old cluster until the cache ages out.  

is this the best approach?  is there a better way?  i really need a way for the cutover to be seamless and we can't go reconfiguring devices to point to a new location every time we upgrade.  

[Charlie Moreton · Accepted solution]

Certificates will break if using your method.

This is a perfect use-case for load balancers.  

https://cs.co/ise-lb

Cloud Load Balancers with ISE

[Greg Gibbs · Accepted solution]

Not all network devices support DNS-based configuration for RADIUS servers. A better solution would be to put a load balancer in front of the PSNs and configure the network devices to use the VIPs for RADIUS servers. You can then update the server pools on the LB as the PSN IP addresses change.

You could also take the approach of replacing the nodes one at a time (or in a group, depending on the deployment) as you build the new cluster to use the same IP addresses without overlap. This would rely on the network devices finding the RADIUS servers dead and moving to the next available, so it's not as fluid as using a load balancer to do that systematically.

The approach would be something like:

• Shutdown the Secondary PAN; rebuild as Primary PAN in new cluster
• Backup/Restore config to new P-PAN
• Shutdown the Secondary MnT; rebuild as Primary MnT in new cluster
• Shutdown one or more PSNs and rebuild; join to new cluster
• Shutdown the remaining PSNs and rebuild; join to new cluster
• Shutdown the Primary PAN and MnT; rebuild as Secondaries in new cluster
• Make the new Secondary PAN the active Primary PAN

[bgoulet00]

Thank you Charlie and Greg.  i will pursue the load balancer option