Cisco ISE1.4更新到2.2的那點事兒……

裝置更新說難也難，說易也易，不過思科的裝置更新其實還是很好的！因為思科有詳細的文檔，隻要詳細閱讀文檔，更新過程一般不會出現問題，如果出現問題，那估計可能跟人品有關了。

友情提示：更新之前一定要仔細閱讀文檔，尤其是那些注意事項。

下面我們詳細說一下從1.4更新到2.2的過程。

首先，思科支援從以下版本直接更新到2.2

Cisco ISE, Release 1.4

Cisco ISE, Release 2.0

Cisco ISE, Release 2.0.1

Cisco ISE, Release 2.1

如果是1.4之前的版本，那麼必須先更新到上面任何一個版本。

思科支援兩種方式更新

1、GUI，圖形界面更新，不過這個方法隻針對2.0以上的版本。

2、CLI，指令行界面更新，這個方法适用1.4以上的版本

而我的版本是1.4的，是以我隻能悲催的使用指令行來更新了。

更新ISE是一個很漫長的過程，我是大約晚上9點來鐘開始更新的，快12點了還沒有更新完成，具體時間沒有計算，因為中間我睡着了，早上醒來更新已經結束了……

下面是官方給出的一個更新時間，僅作參考

<a href="https://s4.51cto.com/wyfs02/M00/90/0C/wKioL1ju_jjzylBGAAA2Ybasg8Y190.png" target="_blank"></a>

我這裡是單節點。

另外，以下因素也會影響到更新的時間

Number of endpoints in your network

Number of users and guest users in your network

Amount of logs in a Monitoring or Standalone node

Profiling service, if enabled

注意：虛拟機的更新時間比實體機的時間要長。

更新之前必須完成以下操作：

Apply Latest Patch to Your Current Cisco ISE Version Before Upgrade

Change VMware Virtual Machine Guest Operating System and Settings

Firewall Ports That Must be Open for Communication

Back Up Cisco ISE Configuration and Operational Data from the Primary Administration Node

Back Up System Logs from the Primary Administration Node

Check the Validity of Certificates

Export Certificates and Private Keys

Disable PAN Automatic Failover and Scheduled Backups Before Upgrade

NTP Server Should Be Configured Correctly and Reachable

Record Profiler Configuration

Obtain Active Directory and Internal Administrator Account Credentials

Activate MDM Vendor Before Upgrade

Create Repository and Copy the Upgrade Bundle

Check Load Balancer Configuration

上面的操作内容是官方列出的，我隻能說如果某一個選項跟你有關，請一定處理好。否則就會出現你想像不到的結果。下面我用血的教訓告訴你。

Initiating Application Upgrade...

% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.

-Checking VM for minimum hardware requirements

% Error: None of the configured ntp servers are reachable. Reconfigure with 'ntp server' command from CLI and then ensure that all nodes in deployment are in sync before retrying upgrade.

% Application install or upgrade cancelled.

上面的提示告訴我NTP伺服器不可達，必須重新配置NTP伺服器，如果不配置好NTP伺服器，你就不用想接着往下走了。

STEP 1: Stopping ISE application...

STEP 2: Verifying files in bundle...

-Internal hash verification passed for bundle

STEP 3: Validating data before upgrade...

System certificate with friendly name 'Default self-signed server certificate' is invalid: The certificate has expired.

% Error:  One or more system certificates are invalid (see above), please update with valid system certificate(s) before continuing. Upgrade cannot continue.

Starting application after rollback...

./isedbupgrade-newmodel.sh: illegal option -- 1

Invalid option: -

% Error: The node has been reverted back to its pre-upgrade state.

上面的提示告訴我系統證書無效，證書過期了，如果你不處理，後面的話也不用我說了

是以一定好好看文檔中的内容，哪些是必須要做的。

下面正式開始更新

先通過sftp把更新包傳到ISE中，這個傳的過程我就不說了，不過在這裡要說的一點是文檔告訴你用sftp必然有他的道理，你不要試圖用ftp啥的，這是吃過虧的人告訴你的！就用sftp。

ise-1/admin# conf t

Enter configuration commands, one per line.  End with CNTL/Z.

ise-1/admin(config)# repository upgrade 

ise-1/admin(config-Repository)# url disk:

% Warning: Repositories configured from CLI cannot be used from the ISE web UI and are not replicated to other ISE nodes. If this repository is not created in the ISE web UI, it will be deleted when ISE services restart.

ise-1/admin(config-Repository)# exit

ise-1/admin(config)# exit

ise-1/admin# application upgrade prepare ise-upgradebundle-1.4.x-to-2.2.0.470.x86_64.tar.gz upgrade 

//這個是預備安裝，是系統模拟安裝，它會對更新包進行校驗，通過這步你可以發現更新包是否有問題。

Getting bundle to local machine...

 md5: 73602a456bdf5f35811832ad43ffa8fe

 sha256: ea21990738a8e20f02f3c6c8eb0f305587ed35c210094cc7f12dec3c3e9fa010

% Please confirm above crypto hash matches what is posted on Cisco download site.

% Continue? Y/N [Y] ? Y

Unbundling Application Package...

Application upgrade preparation successful

下面就是正式更新了！

ise-1/admin# application upgrade proceed 

STEP 4: Taking backup of the configuration data...

STEP 5: Running ISE configuration database schema upgrade...

- Running db sanity check to fix index corruption, if any...

 - Auto Upgrading Schema for UPS Model...

 - Upgrading Schema completed for UPS Model.

ISE database schema upgrade completed.

STEP 6: Running ISE configuration data upgrade...

- Data upgrade step 1/131, UPSUpgradeHandler(1.5.0.136)... Done in 23 seconds.

- Data upgrade step 2/131, UPSUpgradeHandler(1.5.0.139)... Done in 0 seconds.

- Data upgrade step 3/131, ANCRegistration(1.5.0.140)... Done in 0 seconds.

- Data upgrade step 4/131, NSFUpgradeService(1.5.0.149)... Done in 11 seconds.

- Data upgrade step 5/131, UPSUpgradeHandler(1.5.0.150)... Done in 10 seconds.

- Data upgrade step 6/131, NetworkAccessUpgrade(1.5.0.151)... Done in 0 seconds.

- Data upgrade step 7/131, UPSUpgradeHandler(1.5.0.156)... Done in 0 seconds.

- Data upgrade step 8/131, NetworkAccessUpgrade(1.5.0.159)... Done in 0 seconds.

- Data upgrade step 9/131, NetworkAccessUpgrade(1.5.0.162)... Done in 1 seconds.

- Data upgrade step 10/131, NSFUpgradeService(1.5.0.180)... Done in 0 seconds.

- Data upgrade step 11/131, NetworkAccessUpgrade(1.5.0.180)... Done in 0 seconds.

- Data upgrade step 12/131, NetworkAccessUpgrade(1.5.0.181)... Done in 1 seconds.

- Data upgrade step 13/131, UPSUpgradeHandler(1.5.0.183)... Done in 0 seconds.

- Data upgrade step 14/131, NSFUpgradeService(1.5.0.184)... Done in 0 seconds.

- Data upgrade step 15/131, UPSUpgradeHandler(1.5.0.187)... Done in 1 seconds.

- Data upgrade step 16/131, NSFUpgradeService(1.5.0.199)... Done in 0 seconds.

- Data upgrade step 17/131, HostConfigUpgradeService(1.5.0.199)... Done in 0 seconds.

- Data upgrade step 18/131, NetworkAccessUpgrade(1.5.0.201)... Done in 0 seconds.

- Data upgrade step 19/131, NetworkAccessUpgrade(1.5.0.202)... Done in 0 seconds.

- Data upgrade step 20/131, GuestAccessUpgradeService(1.5.0.212)... Done in 5 seconds.

- Data upgrade step 21/131, NSFUpgradeService(1.5.0.234)... Done in 0 seconds.

- Data upgrade step 22/131, UPSUpgradeHandler(1.5.0.244)... Done in 0 seconds.

- Data upgrade step 23/131, NSFUpgradeService(1.5.0.246)... Done in 0 seconds.

- Data upgrade step 24/131, AuthzUpgradeService(1.5.0.252)... Done in 0 seconds.

- Data upgrade step 25/131, NSFUpgradeService(1.5.0.257)... Done in 0 seconds.

- Data upgrade step 26/131, NetworkAccessUpgrade(2.0.0.131)... Done in 0 seconds.

- Data upgrade step 27/131, AuthzUpgradeService(2.0.0.151)... Done in 0 seconds.

- Data upgrade step 28/131, AuthenPolicyUpgradeService(2.0.0.151)... Done in 0 seconds.

- Data upgrade step 29/131, NadProfilePolicyElemUpgradeService(2.0.0.151)... Done in 8 seconds.

- Data upgrade step 30/131, NetworkAccessUpgrade(2.0.0.154)... Done in 0 seconds.

- Data upgrade step 31/131, NetworkAccessUpgrade(2.0.0.156)... Done in 0 seconds.

- Data upgrade step 32/131, NSFUpgradeService(2.0.0.159)... Done in 0 seconds.

- Data upgrade step 33/131, ProvisioningUpgradeService(2.0.0.166)... Done in 0 seconds.

- Data upgrade step 34/131, CADeploymentUpgradeService(2.0.0.190)... Done in 16 seconds.

- Data upgrade step 35/131, NSFUpgradeService(2.0.0.194)... Done in 0 seconds.

- Data upgrade step 36/131, CertMgmtUpgradeService(2.0.0.212)... Done in 1 seconds.

- Data upgrade step 37/131, NSFUpgradeService(2.0.0.220)... Done in 4 seconds.

- Data upgrade step 38/131, NSFUpgradeService(2.0.0.244)... Done in 0 seconds.

- Data upgrade step 39/131, NSFUpgradeService(2.0.0.245)... Done in 0 seconds.

- Data upgrade step 40/131, EPSRegistration(2.0.0.262)... Done in 0 seconds.

- Data upgrade step 41/131, NSFUpgradeService(2.0.0.268)... Done in 0 seconds.

- Data upgrade step 42/131, UPSUpgradeHandler(2.0.0.271)... Done in 0 seconds.

- Data upgrade step 43/131, AuthzUpgradeService(2.0.0.308)... Done in 0 seconds.

- Data upgrade step 44/131, NSFUpgradeService(2.1.0.102)... Done in 0 seconds.

- Data upgrade step 45/131, UPSUpgradeHandler(2.1.0.105)... Done in 30 seconds.

- Data upgrade step 46/131, UPSUpgradeHandler(2.1.0.107)... Done in 0 seconds.

- Data upgrade step 47/131, NSFUpgradeService(2.1.0.109)... Done in 0 seconds.

- Data upgrade step 48/131, NSFUpgradeService(2.1.0.126)... Done in 0 seconds.

- Data upgrade step 49/131, NetworkAccessUpgrade(2.1.0.127)... Done in 0 seconds.

- Data upgrade step 50/131, ProfilerUpgradeService(2.1.0.134)... Done in 0 seconds.

- Data upgrade step 51/131, ProfilerUpgradeService(2.1.0.139)... Done in 0 seconds.

- Data upgrade step 52/131, ProfilerUpgradeService(2.1.0.166)... Done in 47 seconds.

- Data upgrade step 53/131, NSFUpgradeService(2.1.0.168)... Done in 0 seconds.

- Data upgrade step 54/131, AlarmsUpgradeHandler(2.1.0.169)... Done in 2 seconds.

- Data upgrade step 55/131, RegisterPostureTypes(2.1.0.180)... Done in 1 seconds.

- Data upgrade step 56/131, RegisterPostureTypes(2.1.0.189)... Done in 0 seconds.

- Data upgrade step 57/131, UPSUpgradeHandler(2.1.0.194)... Done in 0 seconds.

- Data upgrade step 58/131, TrustsecWorkflowRegistration(2.1.0.203)... Done in 0 seconds.

- Data upgrade step 59/131, NSFUpgradeService(2.1.0.205)... Done in 0 seconds.

- Data upgrade step 60/131, NetworkAccessUpgrade(2.1.0.207)... Done in 0 seconds.

- Data upgrade step 61/131, NSFUpgradeService(2.1.0.212)... Done in 0 seconds.

- Data upgrade step 62/131, NetworkAccessUpgrade(2.1.0.241)... Done in 0 seconds.

- Data upgrade step 63/131, NetworkAccessUpgrade(2.1.0.242)... Done in 0 seconds.

- Data upgrade step 64/131, UPSUpgradeHandler(2.1.0.244)... Done in 0 seconds.

- Data upgrade step 65/131, ProfilerUpgradeService(2.1.0.248)... Done in 0 seconds.

- Data upgrade step 66/131, NetworkAccessUpgrade(2.1.0.254)... Done in 0 seconds.

- Data upgrade step 67/131, UPSUpgradeHandler(2.1.0.255)... Done in 9 seconds.

- Data upgrade step 68/131, MDMPartnerUpgradeService(2.1.0.257)... Done in 0 seconds.

- Data upgrade step 69/131, NetworkAccessUpgrade(2.1.0.258)... Done in 0 seconds.

- Data upgrade step 70/131, ProfilerUpgradeService(2.1.0.258)... Done in 24 seconds.

- Data upgrade step 71/131, MDMPartnerUpgradeService(2.1.0.258)... Done in 0 seconds.

- Data upgrade step 72/131, UPSUpgradeHandler(2.1.0.279)... Done in 0 seconds.

- Data upgrade step 73/131, NSFUpgradeService(2.1.0.282)... Done in 0 seconds.

- Data upgrade step 74/131, NetworkAccessUpgrade(2.1.0.288)... Done in 0 seconds.

- Data upgrade step 75/131, NetworkAccessUpgrade(2.1.0.295)... Done in 0 seconds.

- Data upgrade step 76/131, CertMgmtUpgradeService(2.1.0.296)... Done in 0 seconds.

- Data upgrade step 77/131, NetworkAccessUpgrade(2.1.0.299)... Done in 0 seconds.

- Data upgrade step 78/131, NetworkAccessUpgrade(2.1.0.322)... Done in 0 seconds.

- Data upgrade step 79/131, NetworkAccessUpgrade(2.1.0.330)... Done in 0 seconds.

- Data upgrade step 80/131, NSFUpgradeService(2.1.0.353)... Done in 0 seconds.

- Data upgrade step 81/131, ProfilerUpgradeService(2.1.0.354)... Done in 0 seconds.

- Data upgrade step 82/131, NSFUpgradeService(2.1.0.427)... Done in 0 seconds.

- Data upgrade step 83/131, NSFUpgradeService(2.1.101.145)... Done in 0 seconds.

- Data upgrade step 84/131, ProfilerUpgradeService(2.1.101.145)... Done in 0 seconds.

- Data upgrade step 85/131, UPSUpgradeHandler(2.1.101.188)... Done in 0 seconds.

- Data upgrade step 86/131, NetworkAccessUpgrade(2.2.0.007)... Done in 0 seconds.

- Data upgrade step 87/131, UPSUpgradeHandler(2.2.0.118)... Done in 3 seconds.

- Data upgrade step 88/131, UPSUpgradeHandler(2.2.0.119)... Done in 0 seconds.

- Data upgrade step 89/131, GuestAccessUpgradeService(2.2.0.124)... Done in 15 seconds.

- Data upgrade step 90/131, NSFUpgradeService(2.2.0.135)... Done in 0 seconds.

- Data upgrade step 91/131, NSFUpgradeService(2.2.0.136)... Done in 0 seconds.

- Data upgrade step 92/131, NetworkAccessUpgrade(2.2.0.137)... Done in 0 seconds.

- Data upgrade step 93/131, NetworkAccessUpgrade(2.2.0.143)... Done in 6 seconds.

- Data upgrade step 94/131, NSFUpgradeService(2.2.0.145)... Done in 1 seconds.

- Data upgrade step 95/131, NSFUpgradeService(2.2.0.146)... Done in 1 seconds.

- Data upgrade step 96/131, NetworkAccessUpgrade(2.2.0.155)... Done in 0 seconds.

- Data upgrade step 97/131, CdaRegistration(2.2.0.156)... Done in 1 seconds.

- Data upgrade step 98/131, NetworkAccessUpgrade(2.2.0.161)... Done in 0 seconds.

- Data upgrade step 99/131, UPSUpgradeHandler(2.2.0.166)... Done in 0 seconds.

- Data upgrade step 100/131, NetworkAccessUpgrade(2.2.0.169)... Done in 0 seconds.

- Data upgrade step 101/131, UPSUpgradeHandler(2.2.0.169)... Done in 0 seconds.

- Data upgrade step 102/131, NetworkAccessUpgrade(2.2.0.180)... Done in 0 seconds.

- Data upgrade step 103/131, CertMgmtUpgradeService(2.2.0.200)... Done in 0 seconds.

- Data upgrade step 104/131, NetworkAccessUpgrade(2.2.0.208)... Done in 0 seconds.

- Data upgrade step 105/131, RegisterPostureTypes(2.2.0.218)... Done in 0 seconds.

- Data upgrade step 106/131, NetworkAccessUpgrade(2.2.0.218)... Done in 0 seconds.

- Data upgrade step 107/131, NetworkAccessUpgrade(2.2.0.222)... Done in 0 seconds.

- Data upgrade step 108/131, NetworkAccessUpgrade(2.2.0.223)... Done in 0 seconds.

- Data upgrade step 109/131, NetworkAccessUpgrade(2.2.0.224)... Done in 0 seconds.

- Data upgrade step 110/131, SyslogTemplatesRegistration(2.2.0.224)... Done in 0 seconds.

- Data upgrade step 111/131, ReportUpgradeHandler(2.2.0.242)... Done in 0 seconds.

- Data upgrade step 112/131, IRFUpgradeService(2.2.0.242)... Done in 0 seconds.

- Data upgrade step 113/131, LocalHostNADRegistrationService(2.2.0.261)... Done in 0 seconds.

- Data upgrade step 114/131, DomainControllerUpgrade(2.2.0.299)... Done in 0 seconds.

- Data upgrade step 115/131, NetworkAccessUpgrade(2.2.0.300)... Done in 0 seconds.

- Data upgrade step 116/131, CertMgmtUpgradeService(2.2.0.300)... Done in 0 seconds.

- Data upgrade step 117/131, PolicyUpgradeService(2.2.0.306)... Done in 0 seconds.

- Data upgrade step 118/131, NSFUpgradeService(2.2.0.323)... Done in 0 seconds.

- Data upgrade step 119/131, NetworkAccessUpgrade(2.2.0.330)... Done in 0 seconds.

- Data upgrade step 120/131, NSFUpgradeService(2.2.0.340)... Done in 0 seconds.

- Data upgrade step 121/131, NetworkAccessUpgrade(2.2.0.340)... Done in 0 seconds.

- Data upgrade step 122/131, NetworkAccessUpgrade(2.2.0.342)... Done in 0 seconds.

- Data upgrade step 123/131, AuthzUpgradeService(2.2.0.344)... Done in 0 seconds.

- Data upgrade step 124/131, RegisterPostureTypes(2.2.0.350)... Done in 29 seconds.

- Data upgrade step 125/131, ProfilerUpgradeService(2.2.0.359)... .Done in 81 seconds.

- Data upgrade step 126/131, DictionaryUpgradeRegistration(2.2.0.374)... Done in 11 seconds.

- Data upgrade step 127/131, UPSUpgradeHandler(2.2.0.403)... Done in 0 seconds.

- Data upgrade step 128/131, DictionaryUpgradeRegistration(2.2.0.410)... Done in 0 seconds.

- Data upgrade step 129/131, NSFUpgradeService(2.2.0.470)... Done in 0 seconds.

- Data upgrade step 130/131, ProfilerUpgradeService(2.2.0.470)... Done in 1 seconds.

- Data upgrade step 131/131, GuestAccessUpgradeService(2.2.0.470)... Done in 7 seconds.

STEP 7: Running ISE configuration data upgrade for node specific data...

STEP 8: Running ISE M&amp;T database upgrade...

ISE M&amp;T Log Processor is not running

ISE database M&amp;T schema upgrade completed.

% Warning: Some warnings encountered during MNT sanity check

% NOTICE: The appliance will reboot twice to upgrade software and ADE-OS. During this time progress of the upgrade is visible on console. It could take up to 30 minutes for this to complete.

Rebooting to do Identity Service Engine upgrade...

Connection closed by foreign host.

Disconnected from remote host(ISE) at 23:00:56.

由于我用的SSH登入的，系統重新開機之後連結斷開了，通過控制台可以發現，系統在啟動的過程中會更新很多的東西，也需要花一定的時間。

慢慢等待，之後你就會發現ISE更新完成了！

<a href="https://s2.51cto.com/wyfs02/M01/90/0F/wKiom1jvBeLB1gZeAAQHjrH-imU422.png" target="_blank"></a>

本文轉自 彎月樓主 51CTO部落格，原文連結：http://blog.51cto.com/05wylz/1915544，如需轉載請自行聯系原作者