Upgrading the Cisco Secure Access Control System

Upgrade Paths

You can use the following upgrade paths to upgrade the ACS server from 5.x versions to ACS 5.3:

• Path 1: ACS 5.3 to ACS 5.4.

To upgrade from ACS 5.3 to 5.4, see Upgrading an ACS Server from 5.3 to 5.4.

• Path 2: ACS 5.2 to ACS 5.4.

To upgrade from ACS 5.2 to 5.4, see Upgrading an ACS Server from 5.2 to 5.4.

• Path 3: ACS 5.0/5.1 to ACS 5.2/5.3 to ACS 5.4.

To upgrade from 5.0/5.1 to ACS 5.2, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.2.

To upgrade from 5.0/5.1 to ACS 5.3, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.3.

Note When you upgrade from ACS 5.3 to ACS 5.4 version, it is mandatory to install the patch 8 or a subsequent patch before you start upgrading to ACS 5.4.

Note If you want to upgrade the ACS installed on virtual machine to ACS 5.4, the virtual machine disk size should be greater than or equal to 500 GB.

Upgrading the Secondary Servers

To upgrade each 5.3 secondary server in your deployment to 5.4:

To ensure that you preserve the local certificates of the secondary server, you should promote each secondary server to the primary role, and then perform the ACS 5.4 upgrade. See Upgrading the PKI Data and Certificates.

Before upgrading a secondary ACS server, ensure that the server is not inactive and that it is not in local mode.

To verify the status, from the web interface of the secondary server, select System Administration > Operations > Local Operations and check the status of the secondary ACS server.

Step 1 Verify if the secondary server is a log collector. If so, change the log collector server to any other secondary server; otherwise, proceed to Step 2.

a. From the 5.3 primary server, select System Administration > Configuration > Log Configuration > Log Collector.

ACS displays the current log collector server.

b. From the Select Log Collector drop-down list box, choose a different server to configure as a log collector.

c. Click Set Log Collector.

Step 2 Deregister the secondary server from the 5.3 deployment and delete it from the ACS 5.3 primary server, so that it now becomes a standalone server:

a. Select System Administration > Operations > Distributed System Management.

The Distributed System Management page appears.

b. From the Secondary Instances table, check the check box next to the secondary instance that you want to deregister.

c. Click Deregister.

The system displays the following message:

d. Click OK.

The ACS machine restarts.

e. Log into the ACS 5.3 primary server.

f. Select System Administration > Operations > Distributed System Management.

g. From the Secondary Instances table, check the check box next to the secondary instance that you want to delete.

h. Click Delete.

The following message appears:

i. Click OK.

The Secondary Instances table on the Distributed System Management page appears without the deleted secondary instance.

Step 3 Back up the secondary server data.

From the ACS CLI, issue the following backup command in EXEC mode to perform a backup and place the backup in a repository:

backup backup-name repository repository-name

Note When you back up your data, if the data size exceeds the allowed disk quota of ACS, a warning message is displayed in the CLI, and an alarm is triggered in ACS Monitoring and Reports.

Step 4 Upgrade the ACS server to 5.4. See Upgrading an ACS Server from 5.3 to 5.4.

Step 5 Register the secondary server to the ACS 5.4 primary server.

a. Select System Administration > Operations > Local Operations > Deployment Operations.

The Deployment Operations page appears.

b. Complete the following mandatory fields under the Registration dialog box:

– Primary Instance—The hostname of the 5.4 primary server that you wish to register the secondary instance with.

– Admin Username—Username of an administrator account.

– Admin Password—The password for the administrator account.

– Hardware Replacement—Check to enable the existing ACS instance to re-register with the primary instance and get a copy of the configuration that is already present in the primary instance.

– Recovery Keyword—Specify the same hostname that was used in the 5.3 deployment to ensure that you associate this secondary server with the Monitoring and Report data that was collected earlier.

After you submit this information, this instance connects to the primary instance. The primary instance finds the associated ACS instance records based on the keyword, and marks each record as registered.

c. Click Register to Primary.

The system displays the following message:

d. Click OK.

ACS will restart automatically. Wait for some time to make sure that all processes are up and running successfully.

Note When you register a secondary to a primary instance, you can use any account that is created on the primary instance. The credentials that you create on the primary instance are replicated to the secondary instance.

After the registration is complete, ACS performs a full synchronization and sends the ACS 5.4 configuration data to the 5.4 secondary server.

Step 6 Import local and outstanding Certificate Signing Requests (CSRs).

See the Importing Server Certificates and Associating Certificates to Protocols section and the Generating Self-Signed Certificates section of the User Guide for Cisco Secure Access Control System 5.4.

When there is no secondary server that is registered with the primary server, the primary server itself acts as a log collector. Upgrade the ACS 5.3 primary server to ACS 5.4 once all the secondary servers are upgraded to ACS 5.4.

Upgrading the Primary Server

To upgrade the primary server from a 5.3 to 5.4 deployment:

Step 1 Make sure the primary server is a standalone server:

a. Select System Administration > Operations > Distributed System Management.

The Distributed System Management page appears.

b. Check if there are secondary servers listed in the Secondary Instances table. If there are any secondary servers, upgrade those servers before upgrading the 5.3 primary server. See Upgrading the Secondary Servers.

Step 2 Upgrade the ACS server to 5.4. See Upgrading an ACS Server from 5.3 to 5.4.

Step 3 Register the newly upgraded 5.4 server to the existing primary ACS 5.4 server:

a. Select System Administration > Operations > Local Operations > Deployment Operations.

The Deployment operation page appears.

b. Complete the following mandatory fields under the Registration dialog box:

– Primary Instance—The hostname of the primary server that you wish to register the secondary instance with.

– Admin Username—Username of an administrator account.

– Admin Password—The password for the administrator account.

– Hardware Replacement—Check to enable the existing ACS instance to re-register to the primary instance and get a copy of the configuration that is already present in the primary instance.

– Recovery Keyword—Specify the same hostname that was used in the 5.3 deployment to ensure that you associate this server with the Monitoring and Report data that was collected earlier.

After you submit this information, this instance connects to the primary instance. The primary instance finds the associated ACS instance records based on the keyword, and marks each record as registered.

c. Click Register to Primary.

The system displays the following message:

d. Click OK.

ACS will restart automatically. Wait for some time to make sure that all processes are up and running successfully.

Note When you register a secondary to a primary instance, you can use any account that is created on the primary instance. The credentials that you create on the primary instance are replicated to the secondary instance.

Promote this instance as the ACS 5.4 primary server again. See Promoting a Secondary Server to Primary.

Now the ACS 5.3 deployment is completely upgraded to ACS 5.4.

Upgrading the PKI Data and Certificates

When you upgrade from ACS 5.3 to ACS 5.4 using application upgrade method, ACS restores the Public Key Infrastructure (PKI), the local certificates, and outstanding CSRs.

Reimaging and upgrade method allows you to back up ACS 5.3 instance data and retrieve it in ACS 5.4. If you use reimaging and upgrade method, the PKI, local certificates, and outstanding CSRs in ACS 5.4 instance are erased and the data that is retrieved from ACS 5.3 instance will be stored in ACS 5.4 instance.

Promoting a Secondary Server to Primary

To promote a secondary server to the primary server:

Step 1 From the web interface of the primary server, select System Administration > Operations > Distributed System Management.

The Distributed System Management page appears.

Step 2 In the Secondary Instances table, check the check box next to the secondary server that you want to promote to primary.

Step 3 Click Promote.

The system displays the following message:

Step 4 Click OK.

The system promotes the selected secondary server to primary and moves it to the Primary Instance table. The existing primary server is automatically moved to the Secondary Instances table.

When the registration completes, ACS performs a full synchronization and sends the ACS 5.4 configuration data to the newly promoted primary server.

Restoring the Monitoring and Report Viewer Data After Upgrade

When you restore the backup data after upgrading to 5.4, ACS automatically synchronizes the changes with the database and reports, if any changes are found.

The report data is available only for the period during which you create a backup and not for the period when you restore the data. For example, if you back up the data in June and restore it in August, the report data that is available will be only the data for June and not for August. To get the latest report data, you need to run the reports again.

Upgrading the Database

After the 5.4 upgrade, if you restore the backup that was made prior to the upgrade, ACS displays the database version as AVPair:DBVersion=5.4 and maintains the schema version as 5.4 in the av_system_settings table. When the database process restarts, ACS checks the ACS version and the database version if they are out-of-date and performs a schema and data upgrade.

Upgrading the Reports

After you upgrade to 5.4, if you restore the backup that was made before the upgrade, ACS checks whether the reports tag displays “View 5.4”. Then, when the web process starts up, ACS performs the necessary updates.

Note When you click Switch Database, the logs that are generated after performing step 7 (upgrading the database schema to version 5.2) of the log collector server upgrade are lost. ACS retains only the logs that are generated before you perform step 7.

Upgrading an ACS Server Using the Application Upgrade Bundle

To upgrade an ACS server from 5.3 to 5.4:

Step 1 Place the ACS 5.4 application upgrade bundle (ACS_5.4.tar.gz) in a remote repository.

To configure the repository, follow the procedure that is given in the CLI Reference Guide for Cisco Access Control System 5.4.

Step 2 Enter the following application upgrade command in EXEC mode, to upgrade ACS.

application upgrade ACS_5.4.tar.gz repository-name

ACS displays the following confirmation message:

Do you want to save the current configuration? (yes/no) [yes]?

Note When you upgrade ACS from an older version to version 5.4, if the upgrade bundle size exceeds the allowed disk quota, a warning message is displayed in the CLI, and an alarm is triggered in ACS Monitoring and Reports.

Step 3 Enter yes.

When the ACS upgrade is complete, the following message appears:

% CARS Install application required post install reboot...

The system is going down for reboot NOW!

Application upgrade successful

While ACS upgrades the ACS 5.3 configuration data, it also converts the ACS 5.3 Monitoring and Report Viewer data to the 5.4 format.

Step 4 To monitor the status of the data upgrade, from the Monitoring and Report Viewer, choose Monitoring Configuration > System Operations > Data Upgrade Status.

The Data Upgrade Status page appears, indicating the status of the Monitoring and Report Viewer data upgrade.

When the database upgrade completes, ACS displays the following message:

Upgrade completed successfully.

Step 5 Click OK.

Step 6 Enter the show application version acs command to check whether the ACS version was upgraded successfully.

The following message is displayed:

Cisco ACS VERSION INFORMATION

-----------------------------

Version : 5.4.0.46.0a

Internal Build ID : B.221

Step 7 Enter the show application status acs command in EXEC mode to check whether all the processes are up and running successfully, and press Enter.

The Console displays:

ACS role: PRIMARY

Process 'database' running

Process 'management' running

Process 'runtime' running

Process 'ntpd' running

Process 'adclient' running

Process 'view-database' running

Process 'view-jobmanager' running

Process 'view-alertmanager' running

Process 'view-collector' running

Process 'view-logprocessor' running

Now you can see that all the processes are up and running and that ACS is successfully upgraded to version 5.4.

Reimaging and Upgrading an ACS Server

This section explains how to upgrade ACS 5.3 to 5.4 by backing up the ACS 5.3 data and restoring it on re-imaged ACS 5.4 server. You must have physical access to the ACS box to perform this upgrade procedure.

To perform a reimage and upgrade to ACS 5.4:

Step 1 Back up the ACS data from the ACS 5.3 server.

Step 2 Enter the following backup command in EXEC mode to perform a backup and place the backup in a repository.

backup backup-name repository repository-name

Note When you back up your data, if the data size exceeds the allowed disk quota, a warning message is displayed in the CLI, and an alarm is triggered in ACS Monitoring and Reports.

Note Ensure that you use a remote repository for the ACS 5.3 data backup. Otherwise, you might lose the backed-up data after you install 5.4.

Step 3 Use the ACS 5.4 recovery DVD to install ACS 5.4. See Reimaging the ACS Server

This reimages the ACS server to a fresh ACS 5.4 server that does not have any configuration data.

Step 4 Configure a repository in the fresh ACS 5.4 server to restore the backed-up data.

Step 5 Restore the data that was previously backed up in step 2 to the ACS 5.4 server.

Enter the restore command in EXEC mode to restore the backup:

restore filename repository repository-name

Note When you restore the backed-up data, if the data size exceeds the allowed disk quota, a warning message is displayed in the CLI, and an alarm is triggered in ACS Monitoring and Reports.

Note If you restore the CARS backup in a different hardware, then you must change the the IP address of the ACS machine to bring it up and running.

While restoring the data, using the 5.3 backup file, this command restores the ACS 5.3 configuration data. It also converts and upgrades the ACS 5.3 Monitoring and Report Viewer data to the 5.4 format.

If the backed up data size exceeds the allowed disk quota of ACS, a warning message is displayed in the CLI, and an alarm is displayed in ACS Monitoring and Reports.

Step 6 To monitor the status of the data upgrade, from the Monitoring and Report Viewer, choose Monitoring Configuration > System Operations > Data Upgrade Status.

The Data Upgrade Status page appears, indicating the upgrade status of the Monitoring and Report Viewer data.

When the database upgrade completes, the following message is displayed.

Upgrade completed successfully.

Step 7 Click OK.

Warning The ACS restore does not update pki on mgmt/eap. HTTPS uses a self-signed certificate, even though the only cert in the GUI/db was the CA signed one.
The work-around for this is:
1. Create a self-signed temporary self-signed cert and assign EAP/mgmt to it.
2. Re-assign EAP/mgmt to CA signed cert
3. Delete self-signed cert.

Note If the backup data is huge in size, then the extraction process might take a minimum of 1 hour to many hours to complete.

Note Restore the backup file in the same ACS server, to avoid IP conflict issues.