Mastering Cisco ISE Upgrades – Ensuring a Seamless Transition

Oh alright thank you everyone. So today we're gonna be going over mastering your Cisco ICE upgrades ensuring a.00:01Seamless transition. Again, I'm Amanda Short and we have our lovely demo specialist Mish Martinez.00:20Okay, so today's conversation, we're gonna be going over why we need to upgrade, like why upgrade, what entails that, right? So 2nd thing is gonna be plan and prepare. The 3rd is performing the upgrade, and 4th, last but not least.00:30It is your post upgrade task.00:51Now, before we actually jump into this content, I encourage you guys to join our slido. We're gonna have some questions throughout this presentation cause we really wanna know, you know, like which version you're using, what's your favorite way of upgrading and also the.00:53Any requests that you guys want that you want to see within ICE will be gathering all your feedback and reviewing them. Awesome. Okay. Okay.01:12So, again, here's the QR code to join the Slido, and which version are you guys using? We got two X, you know, maybe that's why you're joining. You guys wanna upgrade to three, two or 33435I encourage you guys to.01:28Drop enter into the Slido and send in your responses. Okay, alright, now for preparing preparing for your upgrade.01:46In this section, we'll be discussing a few key things when planning and preparing for your upgrade, including compatibility checks, pre upgrade activities, the URT, which is our upgrade readiness tool, and scheduling your maintenance window.02:06Alright, let's jump into plan and prepare. Again, we're gonna do compatibility checks, upgrade path, pre upgrade activities, URT and maintenance window. So let's jump in. Okay, so.02:25For three four and three five we do have various supported platforms. These displayed right here are EOL which is end of life. So that's the 36 series and the 37 series.02:40And next, also another supported platform. Not only do we have VMware or you know VMware Cloud, AWS, any of those, but also.02:57We have the 3800 series. So the 3800 series we're gonna see much beefier appliances in terms of PSN sessions, standalone sessions, network interfaces.03:14And the disks ok so from a hardware compatibility perspective is important that in hardware invalid environments you need to validate what your existing.03:29Hardware will support. So three one, like e.g. three one won't run in 34 appliances, so it's important to validate whatever hardware you have and for virtual especially with some of the.03:50Mnts, you know, we do get a lot of logs from those psns, so we want to make sure those are, have more resources in terms of that. Also with the resources reserved. Okay.04:09And then we also have support for Active directory, which is 20122012R 22016, and 2019, ICE on VMware Cloud and on the AWS marketplace. We also do Azure VMware.04:24Of course, we do support the UCS or any server running ESXi six.seven and above, but your KVM does have to run like the guest OS as like real red hat.04:45Eight.two. So we also do hyper V and Microsoft Windows server, 20 12R2 or later. Okay, and let's talk about integrations. So Catalyst Center.05:02Is compatible 1.3.3.9 with ICE three oh with the latest patch all the way down to call center two.two.34 with ICE three one.05:20Latest patch. And of course always check the compati compatibility guidance within the release notes of whatever version you're going to. Okay.05:38So we have two options for the upgrade path. So we can do a single step, which is you can upgrade directly to three five if you are currently on versions 3433 or three two, and you can upgrade directly to three four if you have the following version.05:573332 and three one. So you do the two step upgrade. If you are currently using an earlier version than three oh of ICE, you must upgrade.06:191st upgrade to one of the releases that are listed above. So, if you're on three oh you'll have to do kind of like a two step, so you'll have to go to three one or three two before you can go to three four or three five.06:34Right, so now we're gonna go to the pre upgrade work, right? So this is your validations. Prior to this, you must make sure you performed all software compatibility checks from the compatibility matrix or the network devices also.06:59So best practice for 1st and foremost must run a config configuration backup of ICE. While we do not anticipate any issues with the upgrade process, the safest is to actually have like a fallback plan and that's to do like a configuration backup, so.07:16You can do an operational backup depending on your environment, like the requirements of your organization. If you have a large number of custom endpoint groups, it is also a good idea to export a CSV of all your endpoints. It is much faster to import the endpoint CSV.07:35Like in your newest version than it is to restore a full backup of the entire database. So even if in the event that your endpoints lose their static employee assignment during the upgrade is ok because you can upload the CSV.07:58Into context visibility. Next thing we wanna export your certificates and private keys, but we can do this part as the configuration backups the certificates are stored into ICE, are restored into ICE when restoring to a node with the exact same host name.08:16In the event that you built different appliances or built like a new environment and your nodes have different host names, only the default certificates will be installed with your policy configurations. So we want to get an export of those.08:36But in make note of the AD and any external identity store credentials, so including MDM, AD, any RSA, token credentials, and also take screenshots of each PSN in exactly what.08:56Profiling probes you have currently configured. So we also want to purge any unneeded information. So purging actually decreases.09:16Your upgrade time and increases your disk space. So it's also eliminates upgrading bad config such as expired certificates. So we want to make sure we clean up those certs and purge any excess data and purge away any inactive endpoints.09:31Guest accounts. And last but not least, disable automatic failover on the pans. Disable any scheduled backups especially if you're running them at the same time as the scheduled upgrade and.09:51Don't forget to run your upgrade readiness tool, which we will cover in the next slide. Okay, so the upgrade ready readiness tool. So all talking to everyone.10:08When you're doing these upgrades, a lot of them will refer to it as the URT tool. It is a simulation upgrade which is done by cloning your cloning the config which needs to be, so it needs to be ran on the secondary node. Since the config is consistent across the deployment running it on the secondary.10:23Admin makes makes sure that the latest config of the deployment is cloned and is simulated for the upgrade and avoids performance issues once it comes time to upgrade on your primary.10:43Okay. Okay, so the URT actually gives you a time estimate for your upgrade. It's like a demo upgrade if you'll see if you'll consider it that way. So your secondary pan, one MNT and your PS.11:00Son.11:2074 min, and then we'll have your PSN for each or you can do like a group of psns depending on, you know, what iteration you want to do, is 57 min 57 min, and then your primary pan to mnts and a PSN is 67 min, so you.11:21URT, as you can see here estimates hundred and 98 min and your GUI estimate is going to be 660 min.11:41Don't forget also, you can run the on demand health check, which can be triggered for the entire deployment by logging into the primary admin node, going to the GUI, and starting it from the system menu. This can be done at any time, not just before an upgrade, but it's primarily meant for.11:54For upgrade prechecks so that we we can get like a snapshot of how the deployment is doing health wise. So, so what it does is the automatic health check validates ICE deployment against critical errors. So the.12:14Following will be validated, right? So platform support, deployment validation, DNS resolvability, trust store certificate validation, system certificate validation, disk space.12:33NTP reachability, load average, M and D MDM validation and licensing validation. So the result can be easily downloaded from that direct once it's finished, you can download the results, and any critical errors, if they're, you know, have.12:49Happened to come up within that XML can be fixed before the upgrade. So it's important to fix those prior to the upgrade to avoid any issues.13:09And just a side note, this is not a required step for the new split upgrade option we have, and it don't forget the like health check within ICE is not an alternative for the URT. It's rather just serves as like an additional check for like peace of mind.13:19All right. Scheduling your maintenance window, so when you schedule your maintenance window, you should account for any possible downtime, how long the upgrade is likely to take and what teams should communicate, should be communicated in regards of when and how those teams.13:43Would be affected, right?14:02Also consider the tasks that you must perform in the win in the maintenance window versus those that can be performed ahead of time. You can minimize the disruption by carefully planning and doing the preparation. So e.g., you should not wait until the maintenance window to attend.14:05Obtain your obtain your and upload your upgrade packages.14:24Or run the readiness checks or create back, backups and do all the cleanup. Those should be done ahead of your scheduled maintenance window. So this is to cut down also time of your maintenance window. These.14:30Don't require, like, you can do them with the day of and let's say you're upgrading at night, those could be done like the previous day or the morning of, I should say. And finally, you should schedule more time than you think.14:45Is needed. This, you know, gives flexibility for unseen circumstances or issues that could pop up. Okay, so factors that can affect your upgrade time. So you get your number of endpoints, number of users and guest users.15:00There's number of logs in the monitoring or standalone nodes. So profiling service and if enabled.15:20So a lot of customers will only keep like let's say seven days or three days of operational data, and that will minimize the amount of data that needs to be validated and upgraded.15:28So your standalone node that's encompassing all the personas, so admin policy monitoring, the time estimated is 240 min plus 60 min for every twelve to 15 gigs of data, ok?15:45Let's jump down to the distributed. So your secondary node is gonna be 240 min, your policy service node, 180 min monitoring, again, 240 min plus 60 min. So it's every tack on an hour for every 15 to twelve.16:01Twelve gigs of data that is still held onto that mon in that monitoring node.16:21Again of course schedule extra time just in case you need it ok in this section, we're gonna be performing the upgrade. We'll discuss a few key things when planning and preparing your upgrade.16:25This is include compatibility checks.16:45And, deployment types, upgrade types, the process, and your upgrade options, of course. Okay, so in ICE we have various deployment types, right? So we have your lab and evaluation that could be a standalone.16:49Your small HA deployment, which is two nodes, just two nodes with PAN MNT and psns. Those two are gonna be running all the personas. Then we have a medium multi.17:09Deployment multi node deployment. So we have two pans, two mnts and two PX grids. So that would be six nodes, with six psns, sorry. Okay.17:20And then in a very large deployment, we have dedicated pans, so your primary and your secondary, then you have your two dedicated mnts, and then it could support, I don't know, around 50 psns and four PX grid nodes.17:37So, yep, alright, let's go over the upgrade types. So we have split upgrade versus the new split upgrade. So this new split upgrade.17:56Actually, upgrades your nodes and patches and increases stability and reduces that downtime. Lesser time than the old split upgrade which we'll jump back to, and it also does prechecks for you.18:15So, the older way of the split upgrade was a multi step seq sequential process to upgrade your deployment while services are available. This does take longer than, a full upgrade. So.18:30You would 1st, you know, upgrade your secondary, and that would break off into its own deployment and it'd become the primary of kind of like a new deployment, right? Then you'd bring over a PAN.18:47And then you'd do the psns, and then you'd go ahead and bring over, you know, one by one basically. But now with the new split upgrade, you can do it in batches, which we call iterations. So.19:02This will help definitely minimize your time. It'll do pre And it'll, you'll have the added benefit of not needing to do that health check. It'll actually do the checks prior to the split up prior to the upgrade.19:18Upgrade. Okay, and then we have the of course the full upgrade, so the, yeah, like I said, the PAN gets upgraded 1st, but the rest of the upgrades can be done in parallel. There's NO person.19:34Changes. It's more reliable as well.19:54Let's go to, upgrade types, and this is just again the differentiator between the old and the new. So the total time for upgrades for the old method, it's increases because of the sequence. You'll have to do like swing them over one at a time.19:58New upgrade less, increases the number of iterations but it's more of like a batch, I would say. So it usually takes around 7 h for two iterations prior to take about 24 h and running the URT for the new split upgrade.20:17Not required. Prechecks are already available and staging is available, so you can do all this within the GUI. The maximum number of nodes also increases per the iteration. So the old one you can only do four.20:36And now you can do up to 15. And then we have NO post upgrade checks, but you can actually install the patch during the upgrade. So let's say you're going from three three to three five. Now with the new split upgrade option, you can load the, not only that.20:51Version, but the patch, and it'll do it all. Okay, so split upgrade.21:10Okay, so we do have, you know, we can run into some issues and the documentation actually goes through thoroughly on if, if this fails.21:26What happens, you know? So let's say the secondary pan fails. Failure after reboot, a fresh install on the node, after the reboot. So it doesn't like come up or.21:43Anything like that, any services basically. Fresh installing the node and join it back to the deployment. A failure before reboot, the node will automatically join back to the old deployment. So essentially, if like let's say services fail to come up.21:59After the reboot, then a fresh install on that node would need to happen and join it back to the deployment. So like of the upgraded version, so let's say you're going from three three to three five, you would ideally just re image that node to the three five.22:16And then that way you can patch it and join it to the new one.22:35So if the primary PAN upgrade fails, you would just do a fresh install and join back, join to the new deployment as the secondary. So any other node after that, if the failure is before reboot on the node.22:39Automatically joins back to the old deployment, so meaning like to three three and then if it's post reboot and you get the failure, you would do a fresh install, so like going from three three to three five you would just install three five, like fresh.22:59Reimage, if you will, and join it to the new deployment once it's on that patch desired patch. Alright, let's talk about the full full upgrade. This was a pretty interesting edition to an enhanced added.23:18Into three one.23:38That you can upgrade with all the nodes in a new full upgrade method. There are benefits over the split upgrade, so this is a two step process. The upgrade goes through all the nodes in parallel, but this does mean that you will have a.23:41A total outage really, a service outage, right? But it does take less time. Not many organiz organizations I would say have the pleasure of taking a service outage, but it is possible.24:01So there's, the pan gets upgraded 1st and then the rest of the nodes are upgraded in parallel. No persona changes quicker than your split upgrade. It is reliable, but the cons.24:20You know, it's pretty heavy. No NO high availability, but you do get that added you do get that added benefit of.24:37You know, being faster, ok? And upgrade options of course for the split upgrade, we have the CLI based. 1st, upgrade all secondary nodes only then you would do the PAN.24:53And you need to upload the upgrade bundle to all nodes manually, so that's like, you know, the CLI, you know, copy from your, you know, remote repository or remote server. And then the CLI.25:15Ice will push the upgrade bundle to all the nodes, so definitely take in effect, keep in mind like latency between nodes, that can cause.25:30Might cause some issues, but all your nodes should be within the required. I think it's 300 milliseconds, 200 to 300, ideally 200, under 200 milliseconds. But this is a single click upgrade. Yeah.25:46And of course we have the backup and restore. So we would take a backup of like three five or 3433 and we would start restore it on the new version of three five. So.26:03This does minimize downtime. It works really good for virtual deployments. Like let's say if you're, you have you stand up like a whole new virtual environment. This one's running three.26:16Your old one's running three three, other ones running three five, your brand new one, you would want to take that back up and restore it on your three five patch X, right? Again, check the upgrade guides. We have really great upgrade journeys.26:31Available, and I definitely recommend those. Okay, so we have the split upgrade for the GUI. So step one single click upgrade.26:53Two, you can customize the options for your psns. So you can just customize the order in which ones you want in X iteration. Okay, Step three, upgrade psns in tandem or like.27:11Or within like their group, like let's say if you have NO group or something. Okay, Step four, once you're finished, promote the original PAN and MNT. So this is where you would go into the, the GUI and then.27:28Promote to primary. And then step five is install your latest patch. Now the awesome thing again for the new upgrade is that this does this in parallel.27:44So, upgrade options. So we're gonna do the CLI, so this is very manual, so you have to hit each node and load and, you know, make sure it has connectivity to like your repository and.28:02Move that to the, the upgrade bundle, but again, do that before. So it's a manual process of course, Step two, each node needs to be upgraded individually, so you'll have to do the command.28:23You know, and then a copy upgrade image. So the upgrade image can be nine gigs. Some of them are larger, then step four prepare and execute the upgrade.28:37Step five monitor each node individually, and step six is install the latest patch. So this you would be installed, this would be two kind of flows. This is.28:54Normally, this option is normally recommended for troubleshooting purposes if you have run into problems when upgrading with the GUI, but it's very labor intensive I'd say it's not something you can just, you know.29:09Press, go get some coffee, you know, do something else. This is something that you'll actually have to keep typing or monitor the entire time. Alright, and now we have the.29:24Back up and restore, so we can back up, re image, re image the like hardware if you're getting new hardware, re image or you can create the new VMs, and then we would restore.29:40So, on the split upgrade, so step one is back up the configuration database, install, you know, your three supposed to say three X but like whatever version you want to go for the new VM or new hardware.29:55Or you can actually, like I said, re image the existing node. You want to restore your backup, join the nodes to the new deployment and install your latest patch. This is pretty common if you have Vmiss.30:13Also, if you want to increase any disk space or anything like that on your VMs, you would have to reimage anyway, so ideally like you'd create the new VM with your.30:31Desired disk space, memory, whatever, and then load a new image onto it. And then you can restore your backup, ok, so it just depends on which works best for you.30:45The backup and restore complexity wise, it's medium. The GUI is gonna be your easiest choice and the CLI of course is more complex and it's a very manual process. Access to appliances.31:04Or Vmiss required for your backup and restore. Also, pretty minimum, like CLI you need minimum for like the URT I guess for the GUI.31:22And the CLI definitely you'll need your SSH access, and parallel of ability, so backup restore yes GUI, your psns only can do the in parallel, right?31:37And the CLI you can, there are guidelines to which order is con in terms of like best practice. Rollback for backup and restore, it's not possible because it requires like an im a new image.31:56GUI it's pretty limited and CLI yes, ok? And they have like these commands also. So previous artifacts, because.32:15You for the backup and restore, you do need to reimage. It's clean brand new, so you don't carry over unless you want to carry over that operational data or you can, you know, NO previous artifacts ideally would be.32:30Moved over, right? You're starting from a clean slate. So, in the GUI, previous artifacts are maintained, could possibly run into disc issues from previous defects and the CLI.32:47You're also gonna be maintaining that data, ok? And your time in terms of backup and restore is medium, again because you're doing like reimaging and stuff. Your GUI is gonna take a longer time.33:03But your CLI is also a medium, but it does require more active monitoring, right?33:23So, resources, if you have a large number of staff, additional VM resources might be required, and then GUI, a GUI is small because it's just like a single click, so and you can.33:31It'll show you like which stage it's at. So, and then CLI small number of staff, but it definitely like they have to be watching it. Okay, and then errors for the background history store minimal GUI, of course it's always possible, but you definitely.33:48You should follow these best practices?34:08And CLI, we do reserve for like a troubleshooting or like, you know, recommends it to you. It is possible to come up with errors, but if not, you're not skilled at the CLI, then it's not going to be as.34:10It's intuitive. That makes sense.34:30All right, let's go into the full upgrade. Prechecks. So pre checks run on the complete deployment prior to the upgrade. The results are displayed on this page and then you could.34:37You know, you can also run the the health check and it'll download that. So apart from the checks that this step, the upgrade bundle is downloaded to all nodes, download, uploaded to all the nodes, offline data upgrade, which we call the ODU, is ran on.34:53On the secondary admin node.35:12This is, kind of going towards like the, this is what's done in the URT in simultaneously. And finally, it also displays the estimated time for your activity. This also means for a full of.35:14Upgrade.35:34Okay, we can see at the check what's checked in the pre check on this screen on this right hand side. So we're gonna be repository validation, bundle download, memory check, pan failover. Again, ideally, I mean, you have to disable it so but I just.35:38Double checks, and then schedule backup check, config backup configuration data upgrade, platform support check, deployment validation, DNS, reachability, certificate store, certificate validation, system certificate validation.35:58Disk space check and then NTP and time resource check. Now that's, we see a lot of sometimes these pre checks fail due to the NTP so you make want to make sure that you guys have that configured correctly. Load average check, license validation check, and server.36:18Services or process failures.36:37Is important the important one is to get that config database upgrade, and get to that config and make sure that's done before the actual upgrade, like.36:44Apart from the maintenance window, which we'll see in a day demo later. Okay, so let's jump into the slido. We want to hear from you guys still. Which upgrade method do you guys prefer? Do you guys.36:59You know, writer die GUI fans, CLI or backup and restore. Please scan the code and let us know your thoughts.37:16This will be the demo, new split upgrade and CLI upgrade. I'm gonna hand it over to Mitch and he's gonna get that started for y'all. Thanks Amanda. Well, let's start with the demo. Give me a second here to share my screen.37:41There it is.38:11Okay, let's clarify a few things 1st because at the end, the specific, the most important part of this demo is that we are gonna have different phases covered. Through this demo, we are gonna review two different deployments. We have one six node deployment and another eight node deployment. Why? Because.38:13So we're gonna see some differences. Of course, we want to review the new split upgrade, but also what we are looking to do is to review the CLI upgrade.38:33So we're gonna make a difference there and make sure that you identify, e.g., some of the topics that we maybe facing in our real environment. Now, eh, important to mention the six node it's gonna be upgraded to three.38 node to three.four, but you are gonna see some differences in the demo itself.38:43Now, let's review a little bit about the process itself. Well, the 1st important part that we need to take in account whenever we are trying to make that this type of upgrade is that we need to review the version and the patch. It's always important to make sure that we are on the right version or which.39:02Version we are right now at which version we are right now to make that upgrade? Why? Because of course the files are gonna change according to that section.39:22Now, again, we also need to review how the state of the deployment is. Here, e.g., we are entering to the deployment just to make sure that we have the all the notes and we have the right information. Here, e.g., we are double checking a little bit about the current personas that we have. As you may see, we have an ignore deployment. We have different personas.39:31Have the two administration, the two monitoring.39:52And for policy service to PX rate and to device admin. This is gonna be important because we need to identify them correctly whenever we are doing that upgrade. Now, here we have the options full and split upgrade. Be careful because, e.g., here with the split upgrade, once we start, we are gonna see the old screen of the split upgrade.39:54What does this mean that this is not the new split upgrade? We have different stages here and of course we are not gonna be able to make those changes here, as you may see versus the admin and monitoring that then the policy, service notes and then 2nd, the secondary monitor and the primary admin.40:14So what's the reason because of this as you I'm not sure if you realized but the patch we didn't have any patch installed on this version three.two. So the 1st version where we have this installed is in three.two, but patch three. So we need to patch it. Right now we are gonna move to the patch three on the same deployment just to make sure.40:32That now we are seeing the correct information on the upgrade.40:52Now we move directly to the system upgrade, and from here we are gonna see again the full and the split upgrade, the full upgrade is selected by default. We need to choose the split one. And once we click in the start upgrade, we are gonna see some warnings. This precheck is gonna show us a little bit about what's important to consider whenever we are doing that.40:57Data and also awarding that the services will continue working until we reach at a specific stage.41:17Now, eh, of course, afterwards the step six, as we can see here, it mentions that we are gonna stop the services on those specific notes. And this is mainly the screen that we are gonna see whenever we are starting with the new split upgrade. This is gonna be important because it's gonna show how a different.41:24What it is, and of course 2nd step is the checklist. As Amanda mentioned and we were reviewing a little bit about that importance is that we need to double check and review this checklist. It's always important to run it and we're gonna see some details about it because at the end it may impact and it has a critical standpoint here. Of course.41:44The backup is one of the important things that we are gonna be reviewing?42:04I'm gonna show also on the demo a little bit about those steps that we need to follow up, but it's important always to make sure regarding the backup that you have one latest backup at least seven days old, eh at most, sorry, at most seven days also because otherwise we may have tool the information that may affect. Also export certificate.42:07Some private keys, it's critical because it's gonna show or it's gonna give us ability to restore those certificates in case of any issue. Not all certificates should be a.42:27Backup yep not everything, but at least whatever we are using. Why? Because sometimes we are using some certificates that we already imported in some endpoints, in some scenarios is not really recommended, but in case you have that kind of scenario, it's important for you to have also that eh information back up and those.42:38Tickets.42:58Also, we need to review a little bit about the upgrade model and and I saw some questions there. Of course, it's important to have that upgrade model and information on the repository. Why? Because one of the steps that we are gonna see on this specific new split upgrade is that all the information that we are pointing at, it's gonna be uploaded to all the other nodes.43:00The main objective of this is for us to have like the full detail and of course make this process a little bit more automatic.43:20Regarding credentials also again it's important to have the credentials available. Why? Because sometimes I have seen in the scenarios where we are making the upgrade, we lose those credentials and of course, once we lost them, we need to reenter them. It's not a great issue, but of course if we don't have the information at hand.43:28It may create some delay on our upgrade, so be careful with that part. And now let's review a little bit more about the specific details on the deployment. Here what we're gonna review 1st.43:45Is regarding the health checks. Why this important step is gonna show us a little bit about the current state of the ICE and how prepared is to upgrade. E.g., we are seeing here different health checks, the platform support DNS, trust store, system certificate, disk space, NTP load average, and of course, as we are seeing.44:01Most of them green, we have one warning, ok? And that's important to review.44:21If we enter to that specific information, we're gonna find details on the expand to show information here. And as you can see, the DNS resolution succeeded against one of our servers, but the other two are failing, ok? Here something that.44:27Something happens is that you may assume that, hey, I have one DNS working, so I should be good. I shouldn't have any issues. But at the end, this may not be right. We are gonna say in a, in a few minutes why. But of course, always recommended to download that report in case you need it. Of course, you may not use it, but it's also.44:43Always good to have like that backup and have that information at hand.45:02Now, let's move a little bit again to the split upgrade and let's review about the process here, e.g., as you may see, we have the three.two and we we have different batches. It's important to mention that you can be on that minimum batch and also you can be in a.45:07Most recent patch that that's not an issue, but mainly make sure to have at least the 3rd patch on three oh two in case you are looking to do this split upgrade. Here again we have the warnings. We are gonna accept those and we are gonna move to the checklist.45:25Here something important that you're gonna see is that usually we had some topics regarding the URT bundle, ok? Some comments that we made and that were important is for us to for the URT is usually recommended to be run, but here with the new split upgrade, it's not always recommended. As long as we review the checklist and we make sure.45:51That we have everything in place, we should be in the safe side and actually and actually the reason we don't recommend to run the UR model for the new split is because the new split upgrade, it's gonna do a process to review all this information and make sure that we have everything.46:11In in a good state, which we are gonna see in a moment after we review those specific steps. Now, let's review a little bit about the backups. As you can see here, we have a manual backup that was done on 24 February of course this means that we are, we don't have an updated backup. What we would need to do is create a new one.46:26In case you have an old backup, always recommend recommended to create a new one. The reason is because you don't know how many changes you have done after that date. So it's important to have the latest information. And here we are jumping to the certificates. As you may see, we have different certificates. We have the default some.46:46Time certificate. Well, we have the admin and portal roles on the certificate. So it's important to back it up. Now, the would be important. It depends. It depends if you are using it or not. Usually why? Because the it's usually exchanged. And of course that maybe already exchanged with another platform and can.47:06Can be working. If that's the case, the case or the scenario, of course you would need or it would be recommended for you to back up that certificate. If not, probably you can leave it there because you are not using it and you will have another certificate, a new one, but you don't have any exchange or anyone reviewing that certificate, but it's gonna depend a lot. Now.47:26Be careful because sometimes I have received the comment about certificate saying, hey, do I need to back up the certificate? Because I already have the certificate when whenever I create the CSR. And it's like, No wait. That certificate whenever you have the CSR is not gonna work. Why? Because whenever you do.47:46Generate a CSR, a certificate signing request. That certificate is gonna be binded to that certificate signing request. If you don't bind it, you cannot upload it. So it's important always whenever you export that certificate to choose here export certificate and private key. Because whenever you are looking to import a certificate on ICE, you're gonna be.48:06Ask for the certificate and the private key. So be careful and always make sure to export it here with the option export certificate and private key. Of course, we need to define the password and that's gonna be the same password we are gonna use to upload it.48:26Here let's generate the certificate. Sorry export the certificate. As you can see here, we are gonna have a file that we can save and we are gonna have here the information for that certificate. So it's pretty straight.48:46Forward, it's gonna be always something good for you and even before the upgrade I would say it's recommended to do it whenever you're uploading a certificate. Why?49:06Part of the, of the job in the in the systems in all regarding computers is to reduce risk. We know that using a technology always has a risk and what we are looking is to mitigate it or to reduce it. So in this scenario, whenever you load a certificate, it's always recommended to back.49:17It up, the reason behind it is because in case something fails, your hardware fails, something, even the file gets corrupted because.49:36You run a snapshot on being something else at least you're gonna have all the information for you to re recover that instance of of ice. So it's always recommended for you to make sure that you back up those certificates. And now let's jump to the repository because as you saw on the next upgrade, we're gonna.49:43We are requesting to have that repository with the latest information. Here on the repository, we are making sure that we have this information but also we need to make sure that we have the files. Here, e.g., very quickly, you can see the repository and you're gonna see the different files that we need for the upgrade. Now, let's review a little bit more in detail because at the end.50:03This is very, very quick, but if we enter directly to the CLI, what we can do is 1st run a show run, and from there we are gonna gather the information regarding the repository.50:22As you can see here, we have the repository, the name, the URL, and the password. Now, what we can do is also do a show repository, the name of the repository, and we're gonna see the contents, which is gonna be important for us to have the detail about that specific repository and that we have all the files. In this case, e.g., we have the.50:38Bundle and the upgrade bundle that are gonna be important for our upgrade.50:57Also, e.g., here we have the manual config backup in case something happens, we can restore it quickly. So it's good to be prepared. Something that I always mention is it's better to have everything prepared then same of what what I'm gonna gonna do next now that this is failing, so always be prepared and here e.g. we need to review.51:08The Active directory. On the Active directory, as you can see, we don't have that specific node joined. So this we are gonna join it right now, but it's always important and this is an example. In the in case if this happens.51:27Before or after the upgrade, it's important to always have this information to be able to restore that connection and of course make sure that ICE is working correctly. Here it's ready. We have the note already operational. So now we are gonna jump again to the.51:41Administration and to the operate process. Sorry for 1st the operational data pointing, some comment that I forgot to mention here is information regarding database. Usually, as Amanda mentioned, we can push the information on the database. Now, what we are gonna be reviewing here or what's the the.52:01Important on this. Of course, if we have more information, the time that we're gonna take for the backup, it's gonna increase.52:21The time that we are gonna have for the upgrade, it's gonna increase. All the timings whenever we are looking for more information are gonna increase. So it's always important for us to consider if we have a enough information or if we want to reduce it before doing that this process to make it a little bit more faster. Everything is gonna depend. Of course, you are gonna have like a.52:27An Awareness about the time that you are gonna be taking to make this upgrade, but it's always important for you to consider that you can reduce these times by working the database and making, let's say a little lighter the the deployment and that way it will take less time to make that upgrade.52:47Yeah, we have here the checklist. We are gonna click on the next eh on the button next, just to review, which is the next step. Here it's important e.g. to review. We have the secondary admin that it's a pickup automatically, but we can choose.53:05More notes in the in the in the following in this step. We don't need only to choose the secondary admin and the monitor and the primary monitoring, e.g.. We can choose also the psmiss Right now what we are looking to do is to choose half of the, of the notes to make that upgrade and make it much more faster, much more let's say.53:25Time ready eh time impacting or minimizing that time impact. And of course this is gonna depend a lot on.53:45What we are looking to achieve, but here we are gonna do it on two steps. 1st, half of the deployment and then the other half. As you may see here, we are picking the secondary admin, secondary monitoring, one of the device admin psmiss and the PSM. Just to have, make sure that we have redundancy whenever we are doing the process.53:52Now, we are choosing the repository. Here we are gonna see the bundles that we have in the repository, we can pick the the required bundle or what we are looking to do and also choose the patch. Once we're picking up that patch.54:12We're gonna be able to start the preparation. Here is where we are doing those checks, ok? Again, something really familiar to the, to the health check, something that it's not gonna only do the health check, but also as you may see here, we have the bundle download, the repository validation, but also if doing some other steps to verify the state of the deployment.54:26Here we are gonna send information not only do we have the primary admin, but we have the all the four notes that we pick up on the previous step. This is gonna be important because at the end, this is gonna be preparing all those notes, notes to get the the upgrade. So right now right now what we are seeing is that the.54:47Download it's been sent or that bundle download is being sent to all the notes. We have also the conflict backup, we have the configuration data patch bundle as you see, again, a little bit repetitive, but we are seeing even more steps that we we see on the health check. So this is important. It's gonna be a pre check. If you have everything on green or blue, it should be.55:06It should take a little bit more of time, but also the green is good. But if we have something on yellow or red, it's always important to resolve it before doing the upgrade, ok? Again, we have here the DNS and we may assume, hey, I have one DNS working. There is NO issues.55:27Well, let's see in a minute if that has issues consequences or not. Okay, here we we are still reviewing. We we see that everything is green blue except for the DNS, so once we have the option, we're gonna start staging.55:43Here as you see, we are seeing the estimated time for the upgrade. This is only for those four notes that we pick up, so be careful. We're gonna see that there's another time estimate whenever we are doing the remaining notes. That's gonna change on the time a little bit usually it's less time.56:03So we are gonna see that later on the demo, but here let's start the stating. Here it mentions that NO suspension of service is gonna happen, we're still defining, we are preparing the notes, so there's NO impact yet. And that's something good because we still have like the the full deployment. Right now everything is prepared and we can click on next.56:19To start now the process of the upgrade. If we click on next and we jump to the next step, now we are gonna see a different warning. Why? Because in that next step, we are gonna see an impact. Here, e.g., as you may see, we are gonna have now the impact on this specific step. We have this, the 1st iteration.56:39We have the notes that are selected, the estimated time for those notes, and of course that's something important to consider. As I mentioned, we are doing right now two iterations, but this can be done even in more iterations if you are looking to do it that way.56:59Let's click on the start. Here it mentions that the services will stop, so it's important for us to consider that section and make sure that we have everything ready to start with the upgrade. We click on yes and now the update update is gonna be triggered. As you see here, we're gonna start to see in that process.57:16And of course it's always good to have like that information. As Amanda mentioned, right now ICE is gonna start to do everything automatically so we can go and grab a coffee, wait some time. But also something important is that whenever you are able and it's recommended you go to the command line. Why? Because with the command line we can have some visibility.57:34We're gonna see that sometimes it's different the visibility that we have, e.g., when executing a graphic interface against a CLI, but again, even so, we have some visibility.57:54E.g., here we are entering to the note just to make sure that we have access to the console, review a little bit about what's happening with the upgrade and for that we are gonna use the show login application include upgrade. Here we're seeing some of the details, some of the logs that maybe useful for the upgrade, so.58:07It's something that.58:25Usually whenever you have the the option and of course also a little bit of experience, it would be good for you to to enter to the comment if you feel secure about it. Now, eh, here e.g. we are still seeing that the upgrade is in process. Let's give it a second before we jump to the next one. Here.58:26We jump to the next deployment. Why? Well, it's to give you an example on how the process it's gonna be executed. Right now, this is specific six node deployment it's gonna follow up the same steps. We have done exactly the same, but the only topic is that this one, as you may see here, we had an estimated time of 4 h.58:46Hours, 29 min for the 1st iteration. It has completed. We have an upgrade completed successfully, and this is looking good, ok? So right now what we're gonna be doing, let's review also the specifics on this on this on this upgrade, we have the the different reports from.59:05Regarding the notes, the upgrade and the upgrade report itself, it's always recommended for you to have it. And the reason I mentioned I mentioned this is because whenever we are doing the upgrade, if everything was successful, probably we are not looking to follow up and say, hey, we have everything it's looking good, that's fine. But in case not it doesn't happen or we have.59:25Any issues, those reports are gonna be critical for us to have more information. So right now we are gonna choose also in 2nd iteration, the remaining notes. We're gonna be taking a look and making the upgrade process for those three. Let's go ahead.59:45We select in those three notes, we click on next. And here it's important because some of the things that we are gonna see is that we need to choose again the repository, the bundle and the patch. And of course that review of the notes is gonna be done again. Remember that there's some information that it's independent.01:00:01Regarding each one of the notes. E.g., DNS is a configuration that it's done per node. So even if you have it configured correctly in the primary admin, it doesn't mean that one of the psns may fail because it has a different configuration, maybe some different or NTPs and that may cause some different issues. Here, this one is.01:00:21This is different to the previous one because right now everything's looking good. We don't have any issues. Everything let's say, is healthy, so we are gonna start start again the upgrade. Now, this upgrade it's going on.01:00:42We are gonna be reviewing that it's starting to do all the upgraded staging, it's moving the information. It's as I mentioned it's pretty straightforward. It's almost the same as the previous one. So this shouldn't happen like any major issues. But this one what I can tell you that is that it's gonna happen successfully. So.01:00:58Right now everything was correct prepared and we need to jump to the upgrade of the notes now we have here 2nd iteration, as you may see, the time is.01:01:17Much more less than the previous one. It's almost 1 h left than the the 1st iteration. Right now what we are gonna see here is that we are getting an information warning. This one is important. Why? Because in the in a deployment you cannot have only the pan.01:01:38You need to have at least a pan and the monitoring nodes. So here what is it's saying is that at some point of time, the old primary panel it's gonna have the monitoring and it's gonna be also restarted to get that service running, ok? That's important because at the end, whenever the PSN and the monitoring notes move, the deployment cannot.01:01:55Stay with only one admin?01:02:15Without the monitoring here we are seeing the process it's starting and in the meantime, let's review currently the new admin which was a.01:02:17The previous secondary we entered to the.01:02:37To the note right now remember that it's the primary on the new version. Actually, if we go and take a look to the version, we are gonna see that it's on three.four, sorry three.three, the other one is three.four, this one is on three.three, and we're gonna see also on the operating process deteration, this is something good because even from the new deployment, we can.01:02:41Take a look at the upgrading process for the iteration or the next iteration for the remaining notes. So either way on the old one or the new one, we can see this information. So that's gonna be useful for us to have like a more visibility and also start reviewing a little bit more information on the new deployment.01:03:00Here as you can see, we, the remaining time that we have is almost 2 h. Right now the the note 23 and node 25 we have completed and right now we have, we are, we have only the 29 remaining.01:03:19So the 21 and let's go very quickly to the deployment and see what's happening here. As you may see, now we have all the six notes correctly operated. Everything is working fine. We don't have any issues, then know the status is correct. We have the different personas.01:03:34And everything is looking good. Now, let's go back to the node deployment and let's see, let's see what happened with the upgrade. Here we left on the upgrade of the 1st iteration. Let's see how everything went. If we go to the upgrade, oh, we have some issues here.01:03:51We have some errors, the 1st note the failed, this one was the secondary admin. It mentioned completed, but it's it shows also that everything failed here. So the 1st topic that we are gonna do is jump to that to that note because we need to review if it was upgraded or not.01:04:11So let's center very quickly and let's see the version. Remember that this one is the target version is three.four so yep we are on three.four on that secondary.01:04:29That one was upgraded successfully, but something failed. Okay, so we need to review what failed. We have also those upgrade tasks that Amanda is gonna talk us about in a few slides after the demo, but it's always important here you have some reference to the document online and review some of the.01:04:46The Possible test that you can be running to make sure that everything is healthy on the deployment.01:05:06Yeah now let's take a look at the upgrade process and see what happened here or the reason why we have this issue, this one is in three.four as we saw. Everything is correct. The patch is correct. It was installed correctly but.01:05:17Still, we are seeing the issue on the, on the main deployment.01:05:37Of course, the deployment notes only has the 1st notes, we don't have anything and of course this is an issue. We need to troubleshoot that a little bit to to make sure what's happening and make sure that the upgrade is successful to three.four. At the end that's the main objective.01:05:41So right now, it's important to review. Here we have, e.g., the upgrade timeout. Okay, this mentions that the upgrade has timeout. Of course we need to double check what's happening and make sure here we have the reports. That's information that usually we can start to gather. If you are not experienced with ISO or you don't.01:05:59You want to troubleshoot something that it's always recommended is at this point of time or even if you have a proactive tag case, it's good to engage at this moment. That way we can have some guidance about what what to do next. But in the meantime, if you are waiting for, for the tech to be open or if you are waiting for an answer, you can start to gather this information, which is gonna.01:06:18Be helpful for the engineer to also review it. In this case, we're gonna be reviewing a little bit about what's happening here.01:06:38We are downloading the reports, we are gathering this information that it's gonna be important and also we can double check a little bit more of the details. Here, e.g., we are seeing again an upgrade timeout. It's directly the the time and yep, it's canceled on the node.01:06:44Okay, directly as you see under other notes, everything was canceled. The 1st one was has time out and that's pretty much what we have. So we need more information about this to identify what's happening. So let's go back and and take a quick look.01:07:03Of course, if you by any chance say hey, well, this one failed, but let's try to do the next one and you pick the next node. If you do this and you try to move, it's gonna send an error. Why? Because the secondary plan should be part of the iteration.01:07:22So we cannot do anything without that secondary and as Amanda mentioned in one of the lights, it's gonna be important because we have some process that we need to follow up. What do, what do we need to do in case of any failures? Here, this is the guidance.01:07:38There we go. Or Meesh, we cannot hear you. I don't know if you can hear us.01:08:25No, I can't hear you man.01:09:12Can you hear me? No, we can. Yeah. Okay, the headset failed. What was the last part that you could hear? It was when you started the.01:09:26Kind of like that slide that says what to do, if the failure happens pre or post reboot. Okay.01:09:46Yeah, well this is gonna be important because here what it we need to do is to review what is the process that we need to follow up. The reason behind it is because at this point of time since we had the notes upgraded, but it failed?01:10:04We need to rejoin it to the previous deployment. So for this one, what we need to do is we have a failure after the reboot. What we need to do is do a fresh install of the node and join back to the deployment. Why? Because as you saw in the new deployment, Right now we cannot do anything without that node.01:10:22It it should be part of the deployment for us to make that upgrade. So we need to right now review a little bit more of the what happened with that specific note, but also what we are looking to do is make sure that we have a that deployment before doing the upgrade.01:10:40So right now we're gonna exit the wizard. We're gonna review a little bit more about the deployment. As you can see here, we are not seeing it on the previous deployment. Everything, let's say deleted in that node because it's part now of a new deployment. So what we need to do is make sure that we are seeing again here that ISA.01:10:57So, here right now we have everything good, everything is looking good. There are four remaining notes from those four remaining, the three remaining, sorry, everything is looking good. We are only missing that secondary admin. So let's jump and review a little bit about the deployment and what's happening here.01:11:17Let's take a look at the application. Here e.g. with the something important that we need to do is that we need to clear up or clean all the application upgrade. Why? Because it's prepared to do that specific process. And we're we need to restart that process at this.01:11:36Point of time something recommended is even if you haven't reached that or you're still gathering information waiting for an answer, it would be or a best practice to clean up everything that got prepared for that specific process. So we are gonna make a an application upgrade cleanup on all the notes.01:11:55That were prepared and being prepared and as part of the best practice. So let's do that part. Here is the ice eleven application upgrade cleanup and after that we are gonna be jumping.01:12:12Now to them the following new ok? We have everything ready and here we are gonna start also reviewing a little bit about.01:12:29The reinstallation and the claim installation for that specific note that we lost.01:12:49So that's gonna be important. Yep. Remember that we are looking to restore it again to the to the deployment. So right now we are making the configurations again. I'm gonna skip forward here a little bit just for make it a little bit more faster and.01:12:54Here, e.g., it's already on the three.two version batch nine. We we have prepared this note and we need to rejoin it now. So we are gonna go again to the administration system deployment, we are gonna review the information because it's standalone as you can see here, we are making sure that the note is good and now we need to go back and register it on the.01:13:18Previous deployment.01:13:38So I'm gonna advance here a little bit just to make it a little bit more faster. Now, let's review a little bit about what's happening here. Let's review show version, everything needs to patch nine.01:13:42We are good. The show application status is good at this point of time, not seeing if it's if it's coming up ok it's already correctly there.01:14:00Not review the show NTP here e.g. everything is looking good. And why we are doing this because right now something important that we have detected is that in this case the information regarding the specific graphic interface, well of course it failed.01:14:20So what we are gonna be doing next very quickly is make a CLI upgrade. Why? Because remember.01:14:35When necessary and whenever we are experiencing some failures and we don't know what's happening, sometimes the CLI could be a good way to have more visibility. So let's go ahead here we were making a manual review, of course it's important to make sure that we have enough disk disk space that all the checks are done.01:14:41Of course this is gonna be much more harder because you need to do that manual check.01:15:01But of course, it's gonna be critical whenever you are looking to have more visibility. Now here e.g., what we are doing is making sure that that in this case the DNS is working correctly and of course it's I'm sorry, but we are doing it, we need to review.01:15:06And make sure that everything is working fine. So let's review also the, the repository, make sure Let's double check. We have the repositories, everything is there, we have the patch one, the great bundle, we have the now the log button.01:15:24Now let's move very quickly and review the URD because do you remember that usually I mentioned that the URD is not suggested whenever we are doing the new split because a new split is gonna do that process for us. Right now since we don't we're not gonna follow up anymore with the split the new split.01:15:44We're doing the CLI, it would be good to do that double check with the UR. So we're gonna download it and here once we download that a specific URD, we are gonna make sure.01:16:02Let me just run this a little bit more quicker. Here remember that the URD should be run always on the secondary monitoring. So we have the URD there, we are gonna run the application install if you are T and the repository. That way we're gonna start running that URT that it's gonna of course give us importance.01:16:20This information, make a double check and simulate that specific upgrade and make sure that everything is.01:16:40Good and in a good shape, let's say to make the upgrade valid. It's gonna take some time yes, also it's gonna give us, as Amanda mentioned, some information regarding how much time it's gonna take, but that's gonna be important. So let's take a quick look here.01:16:47As you see here, finally it it finished, of course this is a little bit more speed up, but whenever you are doing it it will take some time to do it because of course it's gonna simulate and operate, it takes some time. But here, as you see everything is working fine. We are not seeing any issues.01:17:04Everything looks good? And we have also the time the estimate time for each one of the notes. So right now let's say we are good and we're in a good shape to this do the CLI. So right now what we need to do is prepare.01:17:22Of course the upgrade with application upgrade and the upgrade prepare and the volume, we're gonna start preparing the notes to have that information and make sure that we have everything ready for the CLA. Here as you see we are preparing, it's getting the local machine, it's preparing the.01:17:39For the specific upgrade. And of course this is gonna be taking some time, but it's always important to make sure that we have that visibility let's Okay, we have the upgrade preparation successful.01:17:59That's that's fine. It's working fine. Now we are gonna do the proceed and it's gonna start with that specific upgrade. So we are gonna have more information. CLI always shows more information but also in the command line what we can do is have visibility.01:18:18Here, e.g., we have this device, we are seeing that everything is going good. We are not seeing any issues at this point of time the persona, everything good, it's rebooting. Here we're not seeing anything critical.01:18:34That let's say that confirms the error that we saw, so let's see and continue with this agree. Of course, we are seeing here some information regarding the the specific installation, whatever is looking good at this point of time.01:18:50If we log in, once it finished, we do the show version, we are on three.four NO issues, ok? Show application status, everything is looking good, ok? Let's enter to the to the node. Once we enter to the node, we are seeing again the the version, everything is looking good, the deployment now we have we have this.01:19:05The deployment.01:19:25And NO, right now we are gonna see that on three.four, we everything is looking good. We have three.four NO comments there, NO warnings the deployment should be good. The whole check that's running just to make sure everything is good. We have the DNS topic, the one that we already saw.01:19:26Nothing weird. We didn't have any errors, ok? It's looking good. The deployment looks good. We have the roles. Remember that here we have the monitoring because we cannot miss that monitoring. So it's important. Let's move the the police service notes.01:19:46And let's see what happens here we are preparing again the the different notes. Here we're gonna do it on parallel just to make sure everything is smooth quickly.01:20:01Of course this is not recommended if you don't want to do services because remember that we should have a PSN available, so be careful let's skip with the the preparation.01:20:18Okay, let's proceed with the upgrade. Here as you may see, everything is proceeding smoothly. It's the registering, it's going on.01:20:47Let's see what's happening here. Okay, we have now the notes in the new version, but as you see here, we have an issue. All the notes and status are like in in a constant sync, it's not syncing correctly. So here we have some topics.01:20:56Something has happened on this deployment. Let's go back to the old deployment. We all, we still have the monitoring and administration. Before moving that the the monitoring remember that the administration cannot be alone so you need to enable monitoring on that one. It's gonna be important.01:21:13And once we enable it, it's gonna start restarting the services for another one. But in the meantime, let's also double check what's happening here, eh with the seven the show application status it's already up.01:21:28Okay, it's up. Now we enter, we have the we we should have the new monitoring note there. So let's double check very quickly. Now it's monitoring, it's ready, we can move the secondary monitoring or the primary currently, the primary now as a monitoring to the new deployment.01:21:43And let's review. Here we are gonna start troubleshooting a little bit about what's happening. Also, we have the show application status, everything's looking good. Okay, what's happening or why why that secondary monitoring is not syncing. That's gonna be important because of course it's.01:22:02Not allowing the deployment to finish. Again, here everything is looking good. We have the application status, NO issues here, ok? Now we can use this common show login application just to review and we can see that there's a note here.01:22:22If we're on the show login application lines, we're gonna see that there's a ping failing, ok? So that's important because of course that ping failed, that ping test failed is showing us or giving us a pointer about the issue. Of course, if you're not comfortable troubleshooting this.01:22:42We can always ask for that kill, but also if you want, this is gonna be important for you to troubleshoot. So let's try to ping. Well, the ping is doing, doing working correctly. But of course this is only with the ping, what's happening with the DNS? Oh, the DNS is failing.01:22:58Do you remember that we had that DNS failure from the beginning? Well, of course we had two servers on the DNS that are not answering correctly. So what we're gonna be doing next is removing those servers that are not replying correctly.01:23:16And with that, we are hoping to solve this issue. Let's very quickly go ahead and review it. Now, of course, this is gonna take a restart to take effect. It's gonna be important. So let's review.01:23:31Be careful to down delete all the DNS because one is required always and one is working, so here and it's going on, I'm gonna skip a little bit. As you can see now we are resolving. Now that two DNS were were fixed, now it's resolving if we.01:23:51Review the notes on the deployment. Now all of them are seen. So that was our issue and that's what happened with the new the new at the end we were seeing issues with the DNS that of course caused a conflict on the installation or the upgrade.01:24:09And that's the reason it failed. Now, of course, the, the only two remaining parts is to move the monitoring 1st. We need to move it to the upgrade it and move it to the new one. Here, e.g., we are moving the monitoring role from the primary admin because we don't want or it's required for us to have.01:24:26Or being able to create that monitoring note from the to the new one. Once it's finished, we are gonna see the new ice name. It's already there as the monitoring on the new node and we only have the I7 remaining.01:24:44So we are gonna upgrade it too, and once it's finished, we are gonna see also that it's already here on our list on the new version. Of course, after this we are ending with this demo. Remember to always apply the patch if you are doing through the CLI because.01:25:00That's gonna be a recommended part. Always try to install the latest patch once you have finished your installation in case you're not doing new split upgrade because a new split upgrades already includes that part. But thanks for the time and go back going back with you and then.01:25:20Awesome. Thank you thank you Perfect. All right, let's jump into the post upgrade tasks.01:25:42So, these are the best practices for post upgrade tasks. So run the on demand health check, which makes like it's basically a sanity check. And as you saw in the demo.01:25:59It goes through and it tells you exactly what the errors are, and you can even download those. So, we want to do a cleanup before the upgrade.01:26:19So application upgrade cleanup from the CLI only for split upgrade, test and verify your use cases and authentication. So we want to make sure you do that within your maintenance window. Reconfigure your scheduled backups.01:26:34And you can run another manual backup. And if you like, you can enable your automatic pan failover and configure your heartbeat for your your primary admin nodes. Okay.01:26:51Alright, so key points to remember, if you take anything away, choose your upgrade path as well as your upgrade type. So that's split upgrade versus a new split upgrade versus the full upgrade method. And then always, always prepare your system for the upgrade.01:27:11You can install your latest patch, for the current, for the release for your up after you upgrade, so that's either the new split upgrade, you can do it all in one GUI interface or you can, do it post installing.01:27:30The upgrade bundle. And of course your post upgrade tasks, which is checking every use case that you have ensuring your PS grid clients are connecting, your authentications are going great. Yeah.01:27:46Things like that, and up next. So if you guys please can join for one more Slido question, not question, but we wanna hear your ideas for ICE features, right? Our team works very closely with the product management team, and we would love.01:28:02To hear out your ideas and get those formally submitted.01:28:22But I super appreciate any feedback that is provided. Again, any feedback provided, we will, you know, read through them and submit your ideas. So.01:28:27It should be an open text response. Appreciate it. So now we have time for some live Q and A with the additional resources. So again, we have great.01:28:43Upgrade guides, so those are called the upgrade journeys and we have a great community. So it's you know/ice community. A lot of those posts are my go TOS, as well as our YouTube channel, we drop the latest features.01:29:01In the releases, so those are always fun to watch at the gym anywhere you are.01:29:22Ensure to check out our compatibility guides licensing, which hasn't changed since three oh but any betas you can reach out to cisco.com/go/CCP.01:29:29And then use the navigation and go to security. And we can continue the conversation on our community post as always. But yeah, if you guys have any live Q and A, this is your time.01:29:45Let's see.01:30:13Okay, go ahead and raise your hand and we can unmute you. Yep, I can take that one.01:30:22Okay, go ahead. Yeah, the 1st operate failed on the graphic interface because at the end we had the DNS issue. With the DNS issue, the notes were not able to join correctly to the or resolve directly to the new to the new admin. So that was an issue. And of course the 1st admin moved correctly.01:30:39But other notes were failing. So it's gonna be important for us for us to have like that as always review and make sure that we resolve that kind of issues, the the yellow ones and the red ones on the prechecks to make sure that everything is going smoothly.01:30:57Also, it's important to mention just for awareness that the session is recorded and it's gonna be shared with everyone after the, after the session itself. It's gonna be sent. And Jacob just point out thank you so much. Shout out to Jacob. He mentioned iceberg. So if you guys have not checked that out.01:31:17It's, iceberg, ICE dashburgh. And this has every single resource you can think of in terms of ICE integrations, you know, best practice deployment guides, all those things. Well.01:31:38I think we are at time. Okay, awesome. Let me get through like the two more slides. That's where i'm done. Okay for more help along your ICE upgrade journey, jump on the ask the expert, sessions.01:31:56Architecture transformation planning, ICE deployment considerations, and your CX services. So what we do is advise, assist on, you know, developing your implementation plans, optimization.01:32:15For your go to technical resource and we can also do some training for you all. What's next for us? So we're back to basics, so the core, you know, ICE topics. So EAP certificates and licensing essentials.01:32:32On 15 October, you can register on that QR code and enhance your security with our cyber capsules. Now they're success capsules, so you can do it in Esponion or English. And those are the QR codes. Oh, I think we got one more.01:32:50I can someone unmute Adrian?01:33:08Yep, can you hear me? Alright, so we are actually running version 3.3. So I don't know if you can recommend to go through version 3.4 or maybe the 3.5 directly. So I don't know.01:33:24If you can recommend something, that's gonna be pretty detailed on what you would like in terms of your organization, some features in.01:33:43Three five that may find appealing to you or three four. They're probably gonna have somewhat of the same if you want to do cloud profiling, like that's in like three five this would enhance your current profiling attributes.01:33:59Which depends on your use cases. Three.three is still supported, it's not end of life, we did just come out with patch twelve, and three four we do have patch seven out and three five patch four. So it's kind of depending on your use cases and what you.01:34:18We're planning within your organization. Okay, but are you using the new split upgrade we can go directly to 3.5 from from 3.3? Yes sir. Okay. Thank you.01:34:37Very welcome. Awesome.01:34:55Alright, and one more question we got Harry if someone can unmute.01:35:17Oh I believe Harry can unmute. You can unmute yourself. Nope.01:35:48So for standalone HA setup, the new split upgrade can be used, correct? So yes, it can. It's just going to, you're just going to stage it the same and it's gonna prepare like send the.01:36:15Upgrade bundle, to the secondary and do it that way.01:36:36Awesome. I think we can conclude this session if there are NO more questions. Awesome. Thanks y'all.01:36:54