Cisco ISE1.4升級到2.2的那點事兒……

設備升級說難也難，說易也易，不過思科的設備升級其實還是很好的！因為思科有詳細的文檔，只要詳細閱讀文檔，升級過程一般不會出現問題，如果出現問題，那估計可能跟人品有關了。

友情提示：升級之前一定要仔細閱讀文檔，尤其是那些注意事項。

下面我們詳細說一下從1.4升級到2.2的過程。

首先，思科支持從以下版本直接升級到2.2

• Cisco ISE, Release 1.4

• Cisco ISE, Release 2.0

• Cisco ISE, Release 2.0.1

• Cisco ISE, Release 2.1

如果是1.4之前的版本，那么必須先升級到上面任何一個版本。

思科支持兩種方式升級

1、GUI，圖形界面升級，不過這個方法只針對2.0以上的版本。

2、CLI，命令行界面升級，這個方法適用1.4以上的版本

而我的版本是1.4的，所以我只能悲催的使用命令行來升級了。

升級ISE是一個很漫長的過程，我是大約晚上9點來鐘開始升級的，快12點了還沒有升級完成，具體時間沒有計算，因為中間我睡著了，早上醒來升級已經結束了……

下面是官方給出的一個升級時間，僅作參考

我這里是單節點。

另外，以下因素也會影響到升級的時間

• Number of endpoints in your network

• Number of users and guest users in your network

• Amount of logs in a Monitoring or Standalone node

• Profiling service, if enabled

注意：虛擬機的升級時間比物理機的時間要長。

升級之前必須完成以下操作：

• Apply Latest Patch to Your Current Cisco ISE Version Before Upgrade

• Change VMware Virtual Machine Guest Operating System and Settings

• Firewall Ports That Must be Open for Communication

• Back Up Cisco ISE Configuration and Operational Data from the Primary Administration Node

• Back Up System Logs from the Primary Administration Node

• Check the Validity of Certificates

• Export Certificates and Private Keys

• Disable PAN Automatic Failover and Scheduled Backups Before Upgrade

• NTP Server Should Be Configured Correctly and Reachable

• Record Profiler Configuration

• Obtain Active Directory and Internal Administrator Account Credentials

• Activate MDM Vendor Before Upgrade

• Create Repository and Copy the Upgrade Bundle

• Check Load Balancer Configuration
  

上面的操作內容是官方列出的，我只能說如果某一個選項跟你有關，請一定處理好。否則就會出現你想像不到的結果。下面我用血的教訓告訴你。

Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
-Checking VM for minimum hardware requirements
% Error: None of the configured ntp servers are reachable. Reconfigure with 'ntp server' command from CLI and then ensure that all nodes in deployment are in sync before retrying upgrade.
% Application install or upgrade cancelled.

上面的提示告訴我NTP服務器不可達，必須重新配置NTP服務器，如果不配置好NTP服務器，你就不用想接著往下走了。

Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
-Checking VM for minimum hardware requirements
STEP 1: Stopping ISE application...
STEP 2: Verifying files in bundle...
-Internal hash verification passed for bundle
STEP 3: Validating data before upgrade...
System certificate with friendly name 'Default self-signed server certificate' is invalid: The certificate has expired.
% Error:  One or more system certificates are invalid (see above), please update with valid system certificate(s) before continuing. Upgrade cannot continue.
Starting application after rollback...
./isedbupgrade-newmodel.sh: illegal option -- 1
Invalid option: -
% Error: The node has been reverted back to its pre-upgrade state.
% Application install or upgrade cancelled.

上面的提示告訴我系統證書無效，證書過期了，如果你不處理，后面的話也不用我說了

所以一定好好看文檔中的內容，哪些是必須要做的。

下面正式開始升級

先通過sftp把升級包傳到ISE中，這個傳的過程我就不說了，不過在這里要說的一點是文檔告訴你用sftp必然有他的道理，你不要試圖用ftp啥的，這是吃過虧的人告訴你的！就用sftp。

ise-1/admin# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ise-1/admin(config)# repository upgrade
ise-1/admin(config-Repository)# url disk:
% Warning: Repositories configured from CLI cannot be used from the ISE web UI and are not replicated to other ISE nodes. If this repository is not created in the ISE web UI, it will be deleted when ISE services restart.
ise-1/admin(config-Repository)# exit
ise-1/admin(config)# exit

ise-1/admin# application upgrade prepare ise-upgradebundle-1.4.x-to-2.2.0.470.x86_64.tar.gz upgrade

//這個是預備安裝，是系統模擬安裝，它會對升級包進行校驗，通過這步你可以發現升級包是否有問題。

Getting bundle to local machine...
 md5: 73602a456bdf5f35811832ad43ffa8fe
 sha256: ea21990738a8e20f02f3c6c8eb0f305587ed35c210094cc7f12dec3c3e9fa010
% Please confirm above crypto hash matches what is posted on Cisco download site.
% Continue? Y/N [Y] ? Y
Unbundling Application Package...
Application upgrade preparation successful

下面就是正式升級了！

ise-1/admin# application upgrade proceed
Initiating Application Upgrade...
% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.
-Checking VM for minimum hardware requirements
STEP 1: Stopping ISE application...
STEP 2: Verifying files in bundle...
-Internal hash verification passed for bundle
STEP 3: Validating data before upgrade...
STEP 4: Taking backup of the configuration data...
STEP 5: Running ISE configuration database schema upgrade...
- Running db sanity check to fix index corruption, if any...
 - Auto Upgrading Schema for UPS Model...
 - Upgrading Schema completed for UPS Model.

ISE database schema upgrade completed.
STEP 6: Running ISE configuration data upgrade...
- Data upgrade step 1/131, UPSUpgradeHandler(1.5.0.136)... Done in 23 seconds.
- Data upgrade step 2/131, UPSUpgradeHandler(1.5.0.139)... Done in 0 seconds.
- Data upgrade step 3/131, ANCRegistration(1.5.0.140)... Done in 0 seconds.
- Data upgrade step 4/131, NSFUpgradeService(1.5.0.149)... Done in 11 seconds.
- Data upgrade step 5/131, UPSUpgradeHandler(1.5.0.150)... Done in 10 seconds.
- Data upgrade step 6/131, NetworkAccessUpgrade(1.5.0.151)... Done in 0 seconds.
- Data upgrade step 7/131, UPSUpgradeHandler(1.5.0.156)... Done in 0 seconds.
- Data upgrade step 8/131, NetworkAccessUpgrade(1.5.0.159)... Done in 0 seconds.
- Data upgrade step 9/131, NetworkAccessUpgrade(1.5.0.162)... Done in 1 seconds.
- Data upgrade step 10/131, NSFUpgradeService(1.5.0.180)... Done in 0 seconds.
- Data upgrade step 11/131, NetworkAccessUpgrade(1.5.0.180)... Done in 0 seconds.
- Data upgrade step 12/131, NetworkAccessUpgrade(1.5.0.181)... Done in 1 seconds.
- Data upgrade step 13/131, UPSUpgradeHandler(1.5.0.183)... Done in 0 seconds.
- Data upgrade step 14/131, NSFUpgradeService(1.5.0.184)... Done in 0 seconds.
- Data upgrade step 15/131, UPSUpgradeHandler(1.5.0.187)... Done in 1 seconds.
- Data upgrade step 16/131, NSFUpgradeService(1.5.0.199)... Done in 0 seconds.
- Data upgrade step 17/131, HostConfigUpgradeService(1.5.0.199)... Done in 0 seconds.
- Data upgrade step 18/131, NetworkAccessUpgrade(1.5.0.201)... Done in 0 seconds.
- Data upgrade step 19/131, NetworkAccessUpgrade(1.5.0.202)... Done in 0 seconds.
- Data upgrade step 20/131, GuestAccessUpgradeService(1.5.0.212)... Done in 5 seconds.
- Data upgrade step 21/131, NSFUpgradeService(1.5.0.234)... Done in 0 seconds.
- Data upgrade step 22/131, UPSUpgradeHandler(1.5.0.244)... Done in 0 seconds.
- Data upgrade step 23/131, NSFUpgradeService(1.5.0.246)... Done in 0 seconds.
- Data upgrade step 24/131, AuthzUpgradeService(1.5.0.252)... Done in 0 seconds.
- Data upgrade step 25/131, NSFUpgradeService(1.5.0.257)... Done in 0 seconds.
- Data upgrade step 26/131, NetworkAccessUpgrade(2.0.0.131)... Done in 0 seconds.
- Data upgrade step 27/131, AuthzUpgradeService(2.0.0.151)... Done in 0 seconds.
- Data upgrade step 28/131, AuthenPolicyUpgradeService(2.0.0.151)... Done in 0 seconds.
- Data upgrade step 29/131, NadProfilePolicyElemUpgradeService(2.0.0.151)... Done in 8 seconds.
- Data upgrade step 30/131, NetworkAccessUpgrade(2.0.0.154)... Done in 0 seconds.
- Data upgrade step 31/131, NetworkAccessUpgrade(2.0.0.156)... Done in 0 seconds.
- Data upgrade step 32/131, NSFUpgradeService(2.0.0.159)... Done in 0 seconds.
- Data upgrade step 33/131, ProvisioningUpgradeService(2.0.0.166)... Done in 0 seconds.
- Data upgrade step 34/131, CADeploymentUpgradeService(2.0.0.190)... Done in 16 seconds.
- Data upgrade step 35/131, NSFUpgradeService(2.0.0.194)... Done in 0 seconds.
- Data upgrade step 36/131, CertMgmtUpgradeService(2.0.0.212)... Done in 1 seconds.
- Data upgrade step 37/131, NSFUpgradeService(2.0.0.220)... Done in 4 seconds.
- Data upgrade step 38/131, NSFUpgradeService(2.0.0.244)... Done in 0 seconds.
- Data upgrade step 39/131, NSFUpgradeService(2.0.0.245)... Done in 0 seconds.
- Data upgrade step 40/131, EPSRegistration(2.0.0.262)... Done in 0 seconds.
- Data upgrade step 41/131, NSFUpgradeService(2.0.0.268)... Done in 0 seconds.
- Data upgrade step 42/131, UPSUpgradeHandler(2.0.0.271)... Done in 0 seconds.
- Data upgrade step 43/131, AuthzUpgradeService(2.0.0.308)... Done in 0 seconds.
- Data upgrade step 44/131, NSFUpgradeService(2.1.0.102)... Done in 0 seconds.
- Data upgrade step 45/131, UPSUpgradeHandler(2.1.0.105)... Done in 30 seconds.
- Data upgrade step 46/131, UPSUpgradeHandler(2.1.0.107)... Done in 0 seconds.
- Data upgrade step 47/131, NSFUpgradeService(2.1.0.109)... Done in 0 seconds.
- Data upgrade step 48/131, NSFUpgradeService(2.1.0.126)... Done in 0 seconds.
- Data upgrade step 49/131, NetworkAccessUpgrade(2.1.0.127)... Done in 0 seconds.
- Data upgrade step 50/131, ProfilerUpgradeService(2.1.0.134)... Done in 0 seconds.
- Data upgrade step 51/131, ProfilerUpgradeService(2.1.0.139)... Done in 0 seconds.
- Data upgrade step 52/131, ProfilerUpgradeService(2.1.0.166)... Done in 47 seconds.
- Data upgrade step 53/131, NSFUpgradeService(2.1.0.168)... Done in 0 seconds.
- Data upgrade step 54/131, AlarmsUpgradeHandler(2.1.0.169)... Done in 2 seconds.
- Data upgrade step 55/131, RegisterPostureTypes(2.1.0.180)... Done in 1 seconds.
- Data upgrade step 56/131, RegisterPostureTypes(2.1.0.189)... Done in 0 seconds.
- Data upgrade step 57/131, UPSUpgradeHandler(2.1.0.194)... Done in 0 seconds.
- Data upgrade step 58/131, TrustsecWorkflowRegistration(2.1.0.203)... Done in 0 seconds.
- Data upgrade step 59/131, NSFUpgradeService(2.1.0.205)... Done in 0 seconds.
- Data upgrade step 60/131, NetworkAccessUpgrade(2.1.0.207)... Done in 0 seconds.
- Data upgrade step 61/131, NSFUpgradeService(2.1.0.212)... Done in 0 seconds.
- Data upgrade step 62/131, NetworkAccessUpgrade(2.1.0.241)... Done in 0 seconds.
- Data upgrade step 63/131, NetworkAccessUpgrade(2.1.0.242)... Done in 0 seconds.
- Data upgrade step 64/131, UPSUpgradeHandler(2.1.0.244)... Done in 0 seconds.
- Data upgrade step 65/131, ProfilerUpgradeService(2.1.0.248)... Done in 0 seconds.
- Data upgrade step 66/131, NetworkAccessUpgrade(2.1.0.254)... Done in 0 seconds.
- Data upgrade step 67/131, UPSUpgradeHandler(2.1.0.255)... Done in 9 seconds.
- Data upgrade step 68/131, MDMPartnerUpgradeService(2.1.0.257)... Done in 0 seconds.
- Data upgrade step 69/131, NetworkAccessUpgrade(2.1.0.258)... Done in 0 seconds.
- Data upgrade step 70/131, ProfilerUpgradeService(2.1.0.258)... Done in 24 seconds.
- Data upgrade step 71/131, MDMPartnerUpgradeService(2.1.0.258)... Done in 0 seconds.
- Data upgrade step 72/131, UPSUpgradeHandler(2.1.0.279)... Done in 0 seconds.
- Data upgrade step 73/131, NSFUpgradeService(2.1.0.282)... Done in 0 seconds.
- Data upgrade step 74/131, NetworkAccessUpgrade(2.1.0.288)... Done in 0 seconds.
- Data upgrade step 75/131, NetworkAccessUpgrade(2.1.0.295)... Done in 0 seconds.
- Data upgrade step 76/131, CertMgmtUpgradeService(2.1.0.296)... Done in 0 seconds.
- Data upgrade step 77/131, NetworkAccessUpgrade(2.1.0.299)... Done in 0 seconds.
- Data upgrade step 78/131, NetworkAccessUpgrade(2.1.0.322)... Done in 0 seconds.
- Data upgrade step 79/131, NetworkAccessUpgrade(2.1.0.330)... Done in 0 seconds.
- Data upgrade step 80/131, NSFUpgradeService(2.1.0.353)... Done in 0 seconds.
- Data upgrade step 81/131, ProfilerUpgradeService(2.1.0.354)... Done in 0 seconds.
- Data upgrade step 82/131, NSFUpgradeService(2.1.0.427)... Done in 0 seconds.
- Data upgrade step 83/131, NSFUpgradeService(2.1.101.145)... Done in 0 seconds.
- Data upgrade step 84/131, ProfilerUpgradeService(2.1.101.145)... Done in 0 seconds.
- Data upgrade step 85/131, UPSUpgradeHandler(2.1.101.188)... Done in 0 seconds.
- Data upgrade step 86/131, NetworkAccessUpgrade(2.2.0.007)... Done in 0 seconds.
- Data upgrade step 87/131, UPSUpgradeHandler(2.2.0.118)... Done in 3 seconds.
- Data upgrade step 88/131, UPSUpgradeHandler(2.2.0.119)... Done in 0 seconds.
- Data upgrade step 89/131, GuestAccessUpgradeService(2.2.0.124)... Done in 15 seconds.
- Data upgrade step 90/131, NSFUpgradeService(2.2.0.135)... Done in 0 seconds.
- Data upgrade step 91/131, NSFUpgradeService(2.2.0.136)... Done in 0 seconds.
- Data upgrade step 92/131, NetworkAccessUpgrade(2.2.0.137)... Done in 0 seconds.
- Data upgrade step 93/131, NetworkAccessUpgrade(2.2.0.143)... Done in 6 seconds.
- Data upgrade step 94/131, NSFUpgradeService(2.2.0.145)... Done in 1 seconds.
- Data upgrade step 95/131, NSFUpgradeService(2.2.0.146)... Done in 1 seconds.
- Data upgrade step 96/131, NetworkAccessUpgrade(2.2.0.155)... Done in 0 seconds.
- Data upgrade step 97/131, CdaRegistration(2.2.0.156)... Done in 1 seconds.
- Data upgrade step 98/131, NetworkAccessUpgrade(2.2.0.161)... Done in 0 seconds.
- Data upgrade step 99/131, UPSUpgradeHandler(2.2.0.166)... Done in 0 seconds.
- Data upgrade step 100/131, NetworkAccessUpgrade(2.2.0.169)... Done in 0 seconds.
- Data upgrade step 101/131, UPSUpgradeHandler(2.2.0.169)... Done in 0 seconds.
- Data upgrade step 102/131, NetworkAccessUpgrade(2.2.0.180)... Done in 0 seconds.
- Data upgrade step 103/131, CertMgmtUpgradeService(2.2.0.200)... Done in 0 seconds.
- Data upgrade step 104/131, NetworkAccessUpgrade(2.2.0.208)... Done in 0 seconds.
- Data upgrade step 105/131, RegisterPostureTypes(2.2.0.218)... Done in 0 seconds.
- Data upgrade step 106/131, NetworkAccessUpgrade(2.2.0.218)... Done in 0 seconds.
- Data upgrade step 107/131, NetworkAccessUpgrade(2.2.0.222)... Done in 0 seconds.
- Data upgrade step 108/131, NetworkAccessUpgrade(2.2.0.223)... Done in 0 seconds.
- Data upgrade step 109/131, NetworkAccessUpgrade(2.2.0.224)... Done in 0 seconds.
- Data upgrade step 110/131, SyslogTemplatesRegistration(2.2.0.224)... Done in 0 seconds.
- Data upgrade step 111/131, ReportUpgradeHandler(2.2.0.242)... Done in 0 seconds.
- Data upgrade step 112/131, IRFUpgradeService(2.2.0.242)... Done in 0 seconds.
- Data upgrade step 113/131, LocalHostNADRegistrationService(2.2.0.261)... Done in 0 seconds.
- Data upgrade step 114/131, DomainControllerUpgrade(2.2.0.299)... Done in 0 seconds.
- Data upgrade step 115/131, NetworkAccessUpgrade(2.2.0.300)... Done in 0 seconds.
- Data upgrade step 116/131, CertMgmtUpgradeService(2.2.0.300)... Done in 0 seconds.
- Data upgrade step 117/131, PolicyUpgradeService(2.2.0.306)... Done in 0 seconds.
- Data upgrade step 118/131, NSFUpgradeService(2.2.0.323)... Done in 0 seconds.
- Data upgrade step 119/131, NetworkAccessUpgrade(2.2.0.330)... Done in 0 seconds.
- Data upgrade step 120/131, NSFUpgradeService(2.2.0.340)... Done in 0 seconds.
- Data upgrade step 121/131, NetworkAccessUpgrade(2.2.0.340)... Done in 0 seconds.
- Data upgrade step 122/131, NetworkAccessUpgrade(2.2.0.342)... Done in 0 seconds.
- Data upgrade step 123/131, AuthzUpgradeService(2.2.0.344)... Done in 0 seconds.
- Data upgrade step 124/131, RegisterPostureTypes(2.2.0.350)... Done in 29 seconds.
- Data upgrade step 125/131, ProfilerUpgradeService(2.2.0.359)... .Done in 81 seconds.
- Data upgrade step 126/131, DictionaryUpgradeRegistration(2.2.0.374)... Done in 11 seconds.
- Data upgrade step 127/131, UPSUpgradeHandler(2.2.0.403)... Done in 0 seconds.
- Data upgrade step 128/131, DictionaryUpgradeRegistration(2.2.0.410)... Done in 0 seconds.
- Data upgrade step 129/131, NSFUpgradeService(2.2.0.470)... Done in 0 seconds.
- Data upgrade step 130/131, ProfilerUpgradeService(2.2.0.470)... Done in 1 seconds.
- Data upgrade step 131/131, GuestAccessUpgradeService(2.2.0.470)... Done in 7 seconds.
STEP 7: Running ISE configuration data upgrade for node specific data...
STEP 8: Running ISE M&T database upgrade...
ISE M&T Log Processor is not running
ISE database M&T schema upgrade completed.
% Warning: Some warnings encountered during MNT sanity check
% NOTICE: The appliance will reboot twice to upgrade software and ADE-OS. During this time progress of the upgrade is visible on console. It could take up to 30 minutes for this to complete.
Rebooting to do Identity Service Engine upgrade...

Connection closed by foreign host.
Disconnected from remote host(ISE) at 23:00:56.

由于我用的SSH登錄的，系統重啟之后鏈接斷開了，通過控制臺可以發現，系統在啟動的過程中會更新很多的東西，也需要花一定的時間。

慢慢等待，之后你就會發現ISE升級完成了！