Release Notes for Cisco Secure ACS to Cisco ISE Migration Tool, 2.2.0.1

Table of Contents

Release Notes for Cisco Secure ACS to Cisco ISE Migration Tool, 2.2.0.1

Contents

Introduction

System Requirements

Migration Tool

Source and Target Migration Machines

Migration Tool Enhancements

Migration Support for ACS 4.2 and 5.5 or later Objects

Using the Bug Search Tool

Search Bugs Using the Bug Search Tool

Resolved Caveats - Migration Tool, Release 2.2.0.1

Open Caveats - Migration Tool, Release 2.2.0.1

Related Documentation

Obtaining Documentation and Submitting a Service Request

Release Notes for Cisco Secure ACS to Cisco ISE Migration Tool, 2.2.0.1

---

First Published: August, 2017

Contents

These release notes pertain to the Cisco Secure Access Control System (ACS) to Cisco Identity Services Engine (ISE) migration tool, Release 2.2.0.1. This release note includes the following sections:

• Introduction
• System Requirements
• Migration Tool Enhancements
• Using the Bug Search Tool
• Resolved Caveats - Migration Tool, Release 2.2.0.1
• Open Caveats - Migration Tool, Release 2.2.0.1
• Related Documentation

 

Introduction

The migration tool 2.2.0.1 migrates the configuration data from the following Cisco Secure ACS versions to Cisco ISE 2.2:

• Cisco Secure ACS 5.5 or later—Select the ACS 5.x Supported Objects option in the migration tool to migrate all data objects.

The migration tool migrates the data objects to Cisco ISE initially followed by the corresponding policy configuration when you migrate the data objects from Cisco Secure ACS 5.5 or later.

• Cisco Secure ACS 4.2—Select the ACS 4.x Supported Objects option in the migration tool to migrate data objects from Cisco Secure ACS 4.2.

The migration tool provides limited support for migration of data objects from Cisco Secure ACS 4.2. The migration tool supports migration of a subset of data objects such as users and devices from Cisco Secure ACS 4.2 to Cisco ISE 2.2. You must manually create the required configuration objects and relevant policy configurations after the completion of the migration process.

Following are the data objects supported for migration from Cisco Secure ACS 4.2 to Cisco ISE:

– Users

– User groups

– User attributes

– Network devices

– Network Device Group (NDG) Nodes

– NDG root type

The latest version of the migration tool is now available on the Download Software Web page . You can download the migration tool even before installing Cisco ISE.

The migration process consists of two phases:

• Export phase—Data is exported from Cisco Secure ACS
• Import phase—Data is imported into Cisco ISE

The migration tool works by importing the Cisco Secure ACS data files, analyzing the data, and making required data modifications that are necessary for importing the data into a format that is usable by Cisco ISE. The data can be exported even if you have only Cisco Secure ACS installed. The migration tool notifies any issues while extracting the data from Cisco Secure ACS. For more information, see Migration Tool Enhancements and Resolved Caveats - Migration Tool, Release 2.2.0.1.

---

Note You must use the appropriate version of the migration tool associated with the Cisco ISE release to migrate data from Cisco Secure ACS to Cisco ISE. Therefore, the migration tool 2.2.0.1 can be used to migrate data only to Cisco ISE 2.2.

---

System Requirements

Migration Tool

Table 1 System Requirements for Migration Tool, 2.2.0.1

Requirement	Description
Operating System	The migration tool runs on Windows and Linux machines. The machine should have Java version 1.8 or later, installed on it.
Minimum Disk Space	The minimum disk space required is 1 GB. This space is required not only for the installation of the migration tool, but also for storing the migrated data and generating reports and logs.
Memory Space	The minimum RAM required is 2 GB. If you have about 300,000 users, 50,000 hosts, 50,000 network devices, then we recommend that you have a minimum of 2 GB of RAM.

Source and Target Migration Machines

Table 2 System Requirements for Source and Target Migration Machines

Platform	Requirements
Cisco Secure ACS, 4.2	Ensure that you have configured the Cisco Secure ACS source machine to have a single IP address.
Cisco Secure ACS, 5.5 or later	Ensure that you have configured the Cisco Secure ACS source machine to have a single IP address.
Standard Cisco ISE System	Ensure that the Cisco ISE target machine has at least 2 GB of RAM.
Migration machine—Ensure that the migration machine has a minimum of 2 GB of RAM.
64-Bit Windows and Linux	Install Java JRE, version 1.8 or higher 64 Bit. The migration tool will not run if you do not install Java JRE on the migration machines.
32-Bit Windows and Linux	Install Java JRE, version 1.8 or higher 32 Bit. The migration tool will not run if you do not install Java JRE on the migration machines.

Migration Tool Enhancements

This section briefly describes the salient features of the Migration Tool, Release 2.2.0.1:

• Migration Support for ACS 4.2 and 5.5 or later Objects

Migration Support for ACS 4.2 and 5.5 or later Objects

The migration tool provides options to migrate ACS 4.2 and ACS 5.5 or above supported objects. You must select ACS 5.x Supported Objects or ACS 4.x Supported Objects option to start the migration process . The migration tool lists the data objects based on the selected option.

If you are migrating ACS 4.x objects, consider the following:

• You must run the migration tool only on a ACS 4.x machine.
• You must run the migration tool from a VNC connected ACS 4.x machine.

---

Note It is not necessary to add the Cisco Secure ACS CA certificate or Cisco Secure ACS management certificate to export the data objects from ACS if you are migrating the ACS 4.x supported objects.

---

Using the Bug Search Tool

This section explains how to use the Bug Search Tool to search for a specific bug or to search for all bugs in a release.

• Search Bugs Using the Bug Search Tool

Search Bugs Using the Bug Search Tool

You can use the Bug Search Tool to view the list of outstanding and resolved bugs in a release. This section explains how to use the Bug Search Tool to search for a specific bug or to search for all the bugs in a specified release.

---

Step 1 Go to https://tools.cisco.com/bugsearch/search .

Step 2 In the Log In screen, enter your registered Cisco.com username and password and click Log In .

The Bug Toolkit page opens.

---

Note If you do not have a Cisco.com username and password, you can register for them at http://tools.cisco.com/RPF/register/register.do.

---

Step 3 To search for a specific bug, enter the bug ID in the Search For field and press Enter.

Step 4 To search for bugs in the current release:

a. Click the Select from list link.

The Select Product page is displayed.

b. Choose Security > Access Control and Policy > Cisco Identity Services Engine.

c. Click OK.

d. When the search results are displayed, use the filter tools to find the types of bugs you are looking for. You can search for bugs based on different criteria such as status, severity, and modified date.

Step 5 Click the Export Results to Excel link in the Search Results page to export all the bug details from your search to an Excel spreadsheet. Currently, up to 10,000 bugs can be exported at a time to the Excel spreadsheet.

---

 

Resolved Caveats - Migration Tool, Release 2.2.0.1

Table 3 lists the caveats that are resolved in this release.

Table 3 Migration Tool, Release 2.2.0.1 - Resolved Caveats

Bug ID	Description
CSCuv19666	Description field is missing in Cisco ISE for some of the objects migrated from ACS 5.x.
CSCvc83704	Migration fails for authorization policies if the authorization rule is configured with the Host Identity Group attribute in the compound condition.
CSCvc87641	Import process fails for the authorization policy with WLC Monitor shell profile while importing policies from ACS to ISE.
CSCvd14151	Authorization profile is not migrated from ACS 5.7 to ISE if user defined dictionary attributes and internal users are configured in the authorization profile.
CSCvd73190	Typo in the Migration tool Export and Import logs.
CSCvd84207	The authorization profile configured with AD shows null value during export if the AD is not joined.
CSCvd97642	Customized descriptions for all the DACLs migrated from ACS are changed to "Migrated from ACS5".
CSCve50643	Description for the network device is corrupted post migration from ACS 5.5 to ISE 2.2.
CSCve55636	Migration of policy fails when the access policy name has more than a single space.
CSCve59500	The migrated authentication rules disappear if the ISE server is restarted.
CSCve79018	TACACS+ Default Shell Profiles that are migrated from ACS 5.x to Cisco ISE shows unexpected results.
CSCvf10147	Device Filters are not exported if the referenced devices does not exist in ACS.
CSCvf10175	Export fails if the policies and shell profile names have UTF-8 character.
CSCvf34213	Access services having trailing space in the name are not migrated.

Open Caveats - Migration Tool, Release 2.2.0.1

Table 4 lists the open caveats in the migration tool release 2.2.0.1.

Table 4 Migration Tool, Release 2.2.0.1 - Open Caveats

Bug ID	Description
CSCvb48112	Migration fails for the objects with same name after renaming the objects, as the object name in Cisco Secure ACS contains special characters that are not supported by Cisco ISE. Workaround Rename the object which is not migrated and re-import the object into Cisco ISE or create the failed object in Cisco ISE after migration.
CSCvf19830	Dictionary attributes are not migrated to Cisco ISE if the compound condition has more than 3 nested conditions in the service selection policy. Workaround Edit the rule to have only three nested compound conditions, perform the migration process and add the required conditions in Cisco ISE after migration.
CSCvf30384	Cisco ISE displays the following error "Policy with name rule_name already exists" when you edit the migrated authorization rule by removing any of the conditions and save the authorization rule. Workaround Create a new authorization rule with the required conditions in Cisco ISE and delete the migrated authorization rule.

Related Documentation

General product information for Cisco Secure ACS is available at http://www.cisco.com/go/acs . End-user documentation is available on Cisco.com at http://www.cisco.com/c/en/us/support/security/secure-access-control-system/tsd-products-support-series-home.html

General product information for Cisco ISE is available at http://www.cisco.com/go/ise . End-user documentation is available on Cisco.com at http://www.cisco.com/en/US/products/ps11640/tsd_products_support_series_home.html .

Table 5 lists the documents available for Cisco ISE, 2.2.

 

Table 5 Product Documentation for Cisco Identity Services Engine, 2.2

Document Title	Location
User Guide for Cisco Secure ACS to Cisco ISE Migration Tool, 2.2.0.1	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-guides-list.html
Release Notes for the Cisco Identity Services Engine, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-release-notes-list.html
Cisco Identity Services Engine Admin Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html
Cisco Identity Services Engine Hardware Installation Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-guides-list.html
Cisco Identity Services Engine Upgrade Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-guides-list.html
Cisco Identity Services Engine Sponsor Portal User Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-user-guide-list.html
Cisco Identity Services Engine CLI Reference Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-command-reference-list.html
Cisco Identity Services Engine API Reference Guide, Release 2.2	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-command-reference-list.html
Active Directory Integration with Cisco ISE	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html
Cisco ISE In-Box Documentation and China RoHS Pointer Card	http://www.cisco.com/c/en/us/support/security/identity-services-engine/products-documentation-roadmaps-list.html
Network Access Device Profiles with Cisco Identity Services Engine	http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-105-Network_Access_Device_Profiles_with_Cisco_ISE.pdf

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html .

Subscribe to What’s New in Cisco Product Documentation , which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

This document is to be used in conjunction with the documents listed in the “Related Documentation” section.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2017 Cisco Systems, Inc. All rights reserved.