Upgrading a Cisco ISE-PIC deployment is a multi-step process and must be performed in the order specified in this document. Upgrade is expected to take approximately 240 minutes + 60 minutes for every 15 GB of data.

Factors that may affect upgrade time include the number of:

• Endpoints and users in your network

• Logs in the primary node

You must use the Cisco ISE upgrade bundle to upgrade Cisco ISE-PIC. You can download the upgrade bundle from Cisco.com.

In order to upgrade your deployment with minimum-possible downtime while providing maximum resiliency and ability to roll back, and minimum errors, perform the upgrade in the following order:

1. Back up all configuration data before beginning upgrade in order to ensure you can easily roll back manually if necessary.

2. Choose the upgrade process based on your deployment:

   • Standalone deployment

     1. Upgrade the node. Refer to Upgrade a Standalone Node.

     2. Run upgrade verification and network tests after you upgrade the node. Refer to

        Verify the Upgrade Process.

     Note	For details about the parts of this step, refer to: Upgrade a Two-Node Deployment Verify the Upgrade Process

   • High Availability (two nodes) Deployment

     1. Upgrade the secondary node first, keeping the PAN at the previous version until the secondary node upgrade is confirmed, in order to use the PAN for rollback if the initial upgrade fails.

     2. Run upgrade verification and network tests after you upgrade the seconary node.

     3. Upgrade the PAN.

        After upgrading both nodes, the Secondary Administration Node is now the Primary Administration Node, installed with the upgraded version, and the original Primary Administration Node is now the Secondary Administration Node, also installed with the upgraded version.

     4. Re-run the upgrade verification and network tests after you upgrade the Primary Administration Node.

     5. When you finish upgrading the original primary node (the second upgrade), in the Edit Node window from the currently secondary node, click Promote to Primary to promote it to become the Primary Administration Node (as was in your old deployment), if required.

Cisco ISE-PIC offers an Upgrade Readiness Tool (URT) that you can run to detect and fix any data upgrade issues before you start the upgrade process.

Most of the upgrade failures occur because of data upgrade issues. The URT is designed to validate the data before upgrade to identify, and report or fix the issue, wherever possible.

The URT is available as a separate downloadable bundle that can be run on a Secondary Administration Node, for high availability, or on the Standalone Node for a single-node deployment. No downtime is necessary when running this tool.

Warning

In multiple-node deployments, do not run the URT on the Primary Administration Node.

You can run the URT from the Command-Line Interface (CLI) of the Cisco ISE-PIC node. The URT does the following:

1. Verifies that the URT is run on a standalone Cisco ISE-PIC node or a Secondary Administration Node

2. Checks if the URT bundle is less than 45 days old—This check is done to ensure that you use the most recent URT bundle

3. Checks if all the prerequisites are met.

   The following prerequisites are checked by the URT:

   • Version compatibility

   • Disk space

     Note	Verify the available disk size with Disk Requirement Size. If you are required to increase the disk size, reinstall ISE and restore a config backup.

   • NTP server

   • Memory

   • System and trusted certificate validation

4. Clones the configuration database

5. Copies latest upgrade files to the upgrade bundle

   Note	If there are no patches in URT bundle then the output will return: N/A. This is an expected behaviour while installing a hot patch.

6. Performs a schema and data upgrade on the cloned database

   • (If the upgrade on the cloned database is successful) Provides an estimate of time it should take for the upgrade to end.

   • (If the upgrade is successful) Removes the cloned database.

   • (If the upgrade on cloned database fails) Collects the required logs, prompts for an encryption password, generates a log bundle, and stores it in the local disk.

In rare cases, you might have to reimage the Cisco ISE-PIC appliance by using the previous version of ISO image and restoring the data from the backup file. After restoring the data, you can register with the old deployment. Hence, we recommend that you back up the Cisco ISE-PIC configuration data before you start the upgrade process.

Sometimes, upgrade failures that occur because of issues in the configuration database are not rolled back automatically. When this occurs, you get a notification stating that the database is not rolled back, along with an upgrade failure message. In such scenarios, you should manually reimage your system, install Cisco ISE, and restore the configuration data.

Before you attempt to rollback or recovery, generate a support bundle by using the backup-logs command, and place the support bundle in a remote repository.

The following link contains additional resources that you can use when working with Cisco ISE: https://www.cisco.com/c/en/us/td/docs/security/ise/end-user-documentation/Cisco_ISE_End_User_Documentation.html