ISE 1.3 to 2.3 LDAP Mandotory attribute

[vdutt]

Hi All,

One of my customer is upgrading from ISE version 1.3 to 2.3 and has been using LDAP as external identity source. He noticed that ISE version 2.3 has "Group name attribute" mandatory attribute that was not present in 1.3.

Will this result in to upgrade failure? If yes, how to avoid such situation.

Below is the screenshot from ISE 1.3 and 2.3.

a) ISE 1.3

b) ISE 2.3

[ldanny · Accepted solution]

This is an added value in the schema and should not cause upgrade to fail.

Having said that we recommend you always stage in a lab environment before moving to production.

[Jason Kunst]

recommend building new system on 2.3 and building that out to understand how it works and how it’s configured as we have moved to policy sets. This will give you new system to validate and migrate in parallel your network devices and then leave old system minimal nodes as a fallback for historical and reference points

Also keep in mind current golden release is ise 2.2 and unless something is needed in 2.3 would recommend instead using 2.2

Moving from ISE 1.3 will require 2 upgrades as there is no direct from 1.3 to 2.3

Sent from my iPhone

[vdutt]

Thanks Jason !!

[Craig Hyps]

The Group Name attribute and the Group Mapping attribute are compliments of each other, depending on the lookup type,  I cannot recall the default behavior in 1.3, but it makes sense to have both values defined to ensure ISE can determine the attribute which references group members versus an attribute of a member that references the group.