Cisco ISE can be quite challenging for some and here are some notes when I was testing an ISE for upgrade
- DNS server.
ISE relies so much on DNS server especially when you are running more than a single ISE server. It is also part of the PKI infrastructure when you start using certificates. Make sure you have your DNS with the correct entry for all of the ISE servers.
- Certificate Expiration.
Make sure your certificate is not expired when you are performing patch/upgrade.
I tried to use the built-in MAC OSX FTP, SFTP (SSH), Tftp Server (http://ww2.unime.it/flr/tftpserver/”), and TFTPD32 (Windows version) but for whatever reason, the above just didn’t work. I’ve been using those for IOS upgrade and those work just fine.
I ended up using Filezilla Server (https://filezilla-project.org) from Windows box and it worked fine although I had to restarted the FTP Server and Windows box couple of time.
You can check via cli command on the ISE server and see whether it produce an error. If your repository worked, you will see some file listing in it (note that TFTP does not have file listing feature).
FusionISE1/admin# show repository REP_FTP % Error reading directory on remote server FusionISE1/admin# show repository REP_FTP desktop.ini ise-upgradebundle-1.1.x-to-220.127.116.119.i386.tar.gz ise-upgradebundle-1.2.x-to-18.104.22.1686.repackaged.x86_64.tar.gz TEST1-150322-1353.tar.gpg tftpd64
- Copy File to Local Disk.
Since we are transfering large file (>3GB) file, the file might be corrupted during the upgrade. Copy your file from repository to local disk then perform your upgrade.
- MD5 Checksum.
I tried to download the upgrade file from Cisco.com several times but always ended up with wrong MD5 checksum. Then I used the Download Manager (Java applet from Cisco) and it finally has the correct sequence.
- Read the Cisco Documentation.
Cisco Documentation provides good resource on how to upgrade Cisco ISE. Make sure you read this (several times) before performing your upgrade. Try also to search some caveats based on your ISE version.
It took me 10 hours to upgrade from 1.1 to 1.2 with fresh installed single ISE server but it took me only 1 hour to upgrade from 1.2 to 1.3. This ISE was running via VMwware Fusion in my Macbook Pro with minimum CPU/RAM. Your miles may vary and good luck for your upgrade.