Best Practise for rebooting ISE Nodes?

Hello Community,
I administer an ISE installation with two nodes (I am not an ISE Specialist, my job is just to manage the user/mac-adresses... but now I have to move my ISE Nodes from one VMWare Cluster to another VMWare Cluster.
(Both VMWare environments are connected to our enterprise network, but are different environments. vMotion not possible)
I would shutdown ISE02, move it to our new VMWare environment and start it again.
Than I would do this with our ISE01 Node...
Are there any best practises for doing this? (Shutdown application first, stopl replikation etc)?
Can I really simply reboot an ISE Node - or have I consider something bevor I doing this? After I doing this?
Any tasks after reboot?
Thank you for any answer!
ISE01    
Administration, Monitoring, Policy Service    
PRI(A), SEC(M)
ISE02    
Administration, Monitoring, Policy Service    
SEC(A), PRI(M)

There is a lot to consider here.  If changing environments means changing IP Address and IP Scopes, then your policies, profiles, and dACLs would also have to change among other things.  If this is the case, create a new ISE VM in the new environment using the built in evaluation license and recreate the deployment from the old environment using the addressing scheme of the new environment.  Then spin-up a new Secondary node and register it on the Primary.  Once this is done, you can re-host the license from your old environment onto your new environment.  You can use this tool to re-host:
https://tools.cisco.com/SWIFT/LicensingUI/loadDemoLicensee?FormId=3999
If IP Addressing is to remain the same, it gets simpler. 
First, and always, perform a configuration and operational backup.
If downtime is not an issue, or if you have a maintenance window of an hour or so: Simply shut down both nodes.  Transfer them to the New Environment and turn them on, Primary Node first, of course.
If downtime is an issue, shut down the Secondary Node and transfer it to the New Environment.  Start the Secondary Node and when it is up, shut down the Primary Node.  Once services on the primary node have stopped, promote the Secondary Node to Primary Node.
Transfer the OLD Primary Node to the New Environment and turn it on.  It should assume the role of Secondary Node.  If it does not, assign that role through the GUI.
Remember, the correct way to shut down an ISE node is:
application stop ise
halt
By using these commands, the risk of database corruption decreases by about 90% (Remember to always backup).
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
Charles Moreton

Similar Messages

  • What is the best practise for setting dirty flag of a page/view?

    For a page/view, normaylly there are 2 things to do for diry data:
    1. when it's clean, Save button is disabled, when it's dirty, save button is enabled.
    2. when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".
    My thought is: it must be handled at client side, because not all valuechange is auto submitted. E.g., you type the 1st letter of a string in a input box, the server side does not know it, but save button should be enabled immediately.
    Is it possible to capture all valueChange events in a page or a view at client side?
    I'm not sure what is the best practise for setting dirty flag? If there is better solution? Does ADF provide facility for this?

    public void save(ActionEvent event){
    boolean formValid = isFormValid();
       if (formValid) {
      save button is enabled.
        private boolean isFormValid() {
            boolean valid = true;
            if (Check Condition 1) {
                valid = false;
               showErrorMessage1();
            if (Check Condition 2) {
                valid = false;
               showErrorMessage1();
            return valid;
        private void showErrorMessage1() {
                    when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".

  • Best Practise for connecting to Ethernet based device

    Hi,
    I have inherited a system where we have a cDAQ-9181 controlling an vehicle access barrier, with a LabView application on  a PC talking to it via Ethernet.
    (The application is very simple - press a button > send a value to the 9181 unit > opens the barrier )
    All works fine most of the time.
    ( We occasionally get network related errors. The LabView application sometimes thinks another PC has reserved the unit, or gives “error 89130 - device not available for routing” )
    The users would now like to be able to easily run the application from a second PC ( not at the same time ), but this seems to be a problem. If I exit the application on PC “A” and run it on PC “B” it struggles to reserve the chassis, and throws the “89130” error and I have to restart the unit via MAC.
    While I’m a “veteran” control programmer, I’m new to LabView, and would be very grateful for any pointers on “best practise” for talking to devices via Ethernet, or any specific suggestions for handling multiple PCs talking to a single device.
    Thank You.
    Tim.

    Hi Tim,
    Thank you for your post and welcome to the NI forums.
    There are lots of knowledgebase articles on our website and you should be able to find documentation for most of our hardware.
    There is a good troubleshooting guide for cDAQ Ethernet here (http://ae.natinst.com/public.nsf/web/searchinternal/e67b4e4749f378ff862577270059bd4b?OpenDocument) - it outlines the steps to take to ensure you have a stable a connection as possible. You may have already seen it, but the quick-start guide for your specific device may also be worth consulting for best practices. Are these helpful?
    As for using more than one PC - this shouldn't be too much of an issue. I would expect that the resource isn't being closed correctly - when you exit the App on PC 'A', how are you closing off the resource?
    Best regards,
    Eden S
    Applications Engineer
    National Instruments UK & Ireland

  • SAP Best Practises for Logistic Modules

    Dear Reader,
    Does anyone know how to find SAP Best Practises for Netweaver 2004s Logistic scenarios (SD, MM,)
    The old Netwvr 2004 scenarioas are less helpful, especially in Inventory mgmt.
    Thanks

    Check this link, this is the latest I guess.
    [SAP Best Practices|http://help.sap.com/bp_bw370/html/index.htm]
    Cheers,
    Neel.

  • Best practises for replication

    Hi,
    I want to know what is best practise for duration of replicaation of database between two Cisco ACS.
    Regards,
    Atif.

    Hi Atif,
    The replication time interval should always be higher.
    Reason: Everytime you replicate the data it requires ACS services to restart so doing this frequently may affect your production enviroment.
    However, if you want to replicate internal user's password then there is an option to replicate password changes right awayvwithout a full replication.  You can enable this option under System Configuration -> Local Password Management.  With this enabled you could potentially set the replications to a larger interval.
    It also depend how often you do changes in your ACS. If its normal then I would say set it to every sunday 12:00 PM.
    This is how replication happens:
    The primary ACS stops its authentication and creates a copy of the ACSinternal database components that it is configured to replicate. During this
    step, if AAA clients are configured properly, those that usually use the primary ACS fail over to another ACS. The primary ACS resumes its authentication service.
    After the preceding events on the primary ACS, the database replication process continues on the secondary ACS. The secondary ACS stops its authentication service and replaces its database components with the database components that it received from the primary ACS. During this step, if AAA clients are configured properly, those that usually use the secondary ACS fail over to another ACS. The secondary ACS resumes its authentication service.
    HTH
    Regards,
    JK
    Plz rate helpful posts-

  • Best Practises for doing Master Scheduling using SNP

    Hello Gurus ,
                         Can you please suggest the best practises for doing Master Scheduling using SNP . Which engine to use , what would that mean etc
    Regards,
    Nick

    APC Back-UPS XS 1300.  $169.99 at Best Buy.
    Our power outages here are usually only a few seconds; this should give my server about 20 or 25 minutes run-time.
    I'm setting up the PowerChute software now to shut down the computer when 5 minutes of power is left.  The load with the monitor sleeping is 171 watts.
    This has surge protection and other nice features as well.
    -Noel

  • ECC 6.0 upgrade to  Best practise for chemical industry implementation

    Dear All.,
    Please tell me what all the  EHP3 must be updated in the SAP erp ecc 6.0. I have already updated
    SAP_APPL 60304.
    Tell me what is the next Ehp3 required before i start best practise in saint.
    Thanks & Regards,
    Manju

    Dear sir.,
    I have  installed SAP ECC 6.0 for a chemical industry, now am planning to implement Best practise to reduce implementation time.
    1) As per the SAP Quick quide i have downloaded best practise for chemical industry(IS) and implemented through SAINT,  and the prerequisites were maintained as per the SAP notes 774615,1301301,1064635,
    2)The above mentioned notes explains minimum stack11 and sapka=18,sapkb=18,sapbw=20,PI_Basis-2005_1_700=20 and sap_ap=15 to update Ehp3 for SAP_APPL603.
    3) After updating all the above mentioned patch level i implemented the Best practise in saint and that was successful.
    But still  the problem persist in activation of BP by tcode /n/smb/bbi only 70% has been completed and activation stoped with *ABAP program error ASSIGNSUBSTRING_NOT_ALLOWED and relevent note is 1295083*_
    Please  any one tell me, is that required to update all the EHP3 components since i have maintained only SAP_APPL60304.
    What all Ehp3 components should be updated to get a smooth activation og BP for chemical industry.

  • Wats the best practise for performance

    Hi all,
    In my out line i have 15 dimensions and for one dimension i have 39000 members so wat is the best practise for performance , If we have more dimensions and more meebers is there any problem for performance
    so wat is the best practise for dimensions and members??
    Thanks in advance??

    If it is ASO application it is not a problem.
    If it is a BSO application surely it will hit the performance.
    More dimensions will create performance issues.
    If the said 39000 members dimension is a Flat dimension. It will be another issue.
    If BSO is obvious try to split into two models.
    Create intermediate groupings for the Filat dimension.

  • How to install Best Practise for HCM

    Hi all:
        Could you please tell me how to install best practise for HCM , as there is no autoran file.
        Thank you very much!!!
    Best regards
    Frank

    Hi,
    Did you chk this link;
    http://help.sap.com/content/bestpractices/overview/index.htm
    http://help.sap.com/bp_hcmv1600/HCM_US/HTML/index.htm
    Regards
    CSM Reddy

  • Best Practises for Error Handling

    Hello
    I have a PHP front end application and for now an Oracle database in the backend. User defined errors are returned back to PHP front end using RAISE_APPLICATION_ERROR(-20000,'error msg'), the PHP displays the message to the user. We have a problem where we are now going to provide a French version on the application and are stuck at what we are to do with the error messages.
    What is the common practise for this?

    Don't reinvent the wheel. Oracle provides built-in error globalization.
    http://www.morganslibrary.org/reference/pkgs/utl_lms.html
    SQL> set serveroutput on
    SQL> DECLARE
      2   s VARCHAR2(32767);
      3   i PLS_INTEGER;
      4  BEGIN
      5    i := utl_lms.get_message(26052,'rdbms','ora','french', s);
      6 
      7    dbms_output.put_line('before format, message is: ' || s);
      8 
      9    dbms_output.put_line('formatted message is: '|| utl_lms.format_message(s, 96, 'my_string'));
    10  END;
    11  /
    before format, message is: Type %d non pris en charge pour l'expression SQL sur la colonne %s.
    formatted message is: Type 96 non pris en charge pour l'expression SQL sur la colonne my_string.
    PL/SQL procedure successfully completed.
    SQL> ed
    Wrote file afiedt.buf
      1  DECLARE
      2   s VARCHAR2(32767);
      3   i PLS_INTEGER;
      4  BEGIN
      5    i := utl_lms.get_message(26052,'rdbms','ora','german', s);
      6    dbms_output.put_line('before format, message is: ' || s);
      7    dbms_output.put_line('formatted message is: '|| utl_lms.format_message(s, 96, 'my_string'));
      8* END;
      9  /
    before format, message is: Nicht unterstützter Typ %d für SQL-Ausdruck in Spalte %s.
    formatted message is: Nicht unterstützter Typ 96 für SQL-Ausdruck in Spalte my_string.
    PL/SQL procedure successfully completed.If you are writing your own messages then Tubby's recommendation is best but I'd be inclined not to put the messages into a table but rather to put them into a package header as constants which minimizes I/O overhead.

  • Best practise for SAP users who leave the company

    Hi
    Could anyone reccommend a best practise document or give advice on how to deal with SAP user ID's when employee's/contractors/consultants leave? I am the basis admin just starting an SAP implementation and we have no dedicated authorisation team at the moment, so I have been asked to look into this :
    Currently we set the validity date in SU01 to the termination date.
    We chack there are no background jobs scheduled under that user id, if there are, we change the job owner to a valid user (we try to run all background jobs under an admin account).
    We do not delete the user as from an audit point of view I believe it restricts information you can report on and there are implications on change documents etc, so best to lock it with validity dates.
    Can anyone advise further?
    We are running SAP ECC 5.0 on Windows 2003 64 Bit/MS SQL 2000.
    Thanks for any help.

    Hi,
    Different people will tell you different versions of what they believe is best practice, but in my opinion you are already doing reasonably well.
    What I prefer is
    1. Lock ID & set validity date.
    2. Assign user to user group LEAVER or EXPIRED or something similar (helps with reporting) out of SUIM/S_BCE* reports.
    3. Delete role assignment (should you need it, the role assignment will be in the change history docs anyway).
    4. Check background jobs & act accordingly.
    For ease of getting info I prefer not to delete the ID though plenty of people do.

  • Best Practises for Email Addresses?

    Hi Guys,
    Are there any best practise guides / documents / etc. for configuring user's E-mail addresses? We have a large turnaround of users and obviously sometimes they have the same name as previous/current employees (we
    do not delete any old accounts / mailboxes.) My question is whether or not it is OK to use numbers in an email address (i.e. [email protected])?
    Thanks
    Stephen

    Hi,
    It's OK to use numbers in an email address.
    The format of email addresses is local-part@domain where the local-part may be up to 64 characters long and the domain name may have a maximum of 253 characters.
    The local-part of the email address may use any of these ASCII characters RFC 5322
    Uppercase and lowercase English letters (a–z, A–Z) (ASCII: 65-90, 97-122)
    Digits 0 to 9 (ASCII: 48-57)
    Characters !#$%&'*+-/=?^_`{|}~ (ASCII: 33, 35-39, 42, 43, 45, 47, 61, 63, 94-96, 123-126)
    Character . (dot, period, full stop) (ASCII: 46) provided that it is not the first or last character, and provided also that it does not appear two or more times consecutively (e.g. John..[email protected] is not allowed.).
    Special characters are allowed with restrictions. They are:
           Space and "(),:;<>@[\] (ASCII: 32, 34, 40, 41, 44, 58, 59, 60, 62, 64, 91-93)
           The restrictions for special characters are that they must only be used when contained between quotation marks, and that 3 of them (The space, backslash \ and quotation mark " (ASCII: 32, 92, 34)) must also
    be preceded by a backslash \ (e.g. "\ \\\"").
    For more information, please refer to this similar thread.
    https://social.technet.microsoft.com/Forums/exchange/en-US/69f393aa-d555-4f8f-bb16-c636a129fc25/what-are-valid-and-invalid-email-address-characters
    Best Regards.

  • 4400 Controllers - Best Practise for connecting to wired network

    At one time the best practise recommendation for wireless was to treat the traffic as untrusted and separate it from the wired network by firewalls and intrusion detection. A lot of the reason for this was the weakness of WEP. Now with strong authentication and encryption (e.g., WPA2 and EAP-TLS) in use, and the use of wireless controllers, I'm wondering what the industry is recommending (and doing in case the actions aren't the same as the recommendations).
    Are organizations connecting the wireless controllers directly to the internal network or are they separating them with a firewall and IDS infrastructure? If the latter, what does the architecture look like? Are there documents on the Cisco site or on the Internet that show how the controllers could be firewalled? Everthing I've seen shows connections directly to the internal network. Is firewalling the controller an overreaction to the historical paranoia from the WEP days?

    The argument would be that regardless of what security you put on the wireless, you still don't have the physical security - i.e. someone doesn't need to walk into your building to use your network.
    Beyond that if you're using strong auth/enc you can currently be considered safe, we have customers using that direct into their LANs (but then, we also have customers with WEP direct into their LANs!)...
    If you are concerned or really need belt 'n' braces security, then go down the firewall/IDS route - there's no harm in it if you have the money. It really depends how much functionality and ease of use you need to balance against it.
    Aaron
    Please rate helpful posts

  • Best practise for external service when amount is not sure

    Hi friends ,
    What could be the best practise from the PM side when we want to send an equipment for external repair
    and the service cost is not sure .
    Also if we will create only service PR and not PO then there could be some legal problems while sending the equipment outside.
    What I am thinking is to create a service PR -> PO and then setting the actual cost while invoicing .
    Is it fine ?
    We would prefer if we can take some print out of the external service mentioning following data through standard SAP :
    1) Vendor Name
    2) Our Co name .
    3) Address from where the equipment is dispatched
    4) Address where equipment is to be sent .
    5) Contact No .
    6) some Dates
    Any suggestions.
    Regards
    AM
    Edited by: Amehra on Jul 7, 2011 1:53 PM

    Hi,
    it is not necessary to enter the exact amount for external service in PM order ,
    exact amount must be confirmed during service entry sheet ml81n
    or it also be adjusted during miro ( invoicing )
    and for prininting , most of the part as u said are covered in standard printing of Maintenance order, PR and PO
    otherwise there must be customized PO printing in ur organisation that can be change if ur requirements does not meet
    Regards,
    Jitender

  • SDO_PC, multiple SRIDs - best practise for data model?

    Hi,
    im using UTM and I am getting data covering two zones.
    all my existing data is from zone A.
    tables:
    pointcloud
    pointcloud_blk
    now im getting data with very few points from zone A and most points from zone B. It was agreed that the data delivery will be in SRID for zone B.
    so I tested whether this would work. I had two pointclouds. One with SRID A, another with SRID B. As soon as I put SRID B pointcloud inside, I could NO LONGER QUERY pointcloud with SRID A.
    So it seems to be necessary to use at least another pointcloud_blk, f.e. pointcloud_blk_[srid].
    Question: does another pointcloud_blk for each SRID suffice or do i also need a pointcloud table per SRID. the pointcloud table seems only interesting due to its EXTENT column. But on the other hand this could be queried by "function", since there are only 10 or so records (pointclouds) inside.
    PLZ share your best practises. What does work, what not.

    It is necessary to have one pointcloud_blk table for each SRID since there is a spatial index on that table.
    As for the PointCloud table itself, it is up to you. You can have pointclouds with different SRIDs in that table.
    But if you want to create spatial index on it, you have to use some function based index so that the index
    sees one SRID for the table.
    Since this table usually does not have many rows, this should work fine with one table for different SRIDs.
    siva

Maybe you are looking for