ISE Hardware Refresh: Decisions & Risks

2026-03-16

No hardware refresh required

SNS-3755-K9 is enterprise-class, supports ISE 3.3+/3.4. No capacity or compatibility constraints within 18-month window.

Evan

2026-03-16

Software upgrade to 3.3+ recommended

ISE 3.2 SW maintenance ended 2025-10-31. No new patches available. Security risk increases with time.

Evan

2026-03-16

Use netapi --refresh for data collection

Single command aggregates version, patches, nodes, certs, license, backup. Repeatable and scriptable for future assessments.

Evan

2026-03-16

SSH required for hardware specs

ISE ERS/OpenAPI does not expose hardware details (PID, serial, CPU, RAM, disk). Must SSH to each node for show inventory.

Evan

No security patches after 3.2 EOS (2028-10-31)

High

High

Upgrade to 3.3+ within 6-12 months. Track CVEs against current version.

Emergency upgrade if critical CVE published before planned window

Upgrade breaks existing ISE policies or integrations

Medium

High

Test upgrade in domus home lab first. Document all policies before upgrade. Maintain backup.

Restore from backup. Rollback to 3.2 if needed.

Maintenance window unavailable due to hospital operations

Medium

Medium

Schedule during lowest-traffic window (weekend). Rolling upgrade minimizes downtime per node.

Break upgrade into multiple smaller windows (one node at a time)

Certificate expiry during assessment period

Low

High

Monitor via netapi ise get-nodes --certs. Renew any certs expiring within 180 days immediately.

Emergency cert renewal procedure documented in infra-ops

SmartNet coverage lapse on SNS-3755-K9

Low

Medium

Verify SmartNet contract dates. Renew before expiration.

Procure new contract or replacement appliance if lapsed