Patching ISE? UI or CLI?

[adamscottmaster2013]

I have a 4 nodes ISE 3.2 patch-4 cluster:
node1: Primary Admin/Primary MNT
node2: Secondary Admin/Secondary MNT
node3: PSN
node4: PSN

what is the best way to patch these nodes going forward to patch-5 and beyond? I am getting
different answers from Cisco TAC. One TAC engineer recommenend that I use the UI in node1 to
do the patching and another engineer recommended the CLI:

- patch node1 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node3 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node4 via CLI, wait for the node to be rebooted and back into the cluster,
- patch node2 via CLI, wait for the node to be rebooted and back into the cluster,

I've seen in multiple situations that using the UI is NOT very reliable because after node1
got patched, node2...node4 did not get patched.

What is the best and support way to patch my ISE cluster? Also is the CLI sequence of patching correct?

TIA

[ahollifield · Accepted solution]

CLI, much easier to monitor/control.  The CLI gives you progress output that the GUI does not.

[adamscottmaster2013]

In my scenario, what would be the correct sequence?

[ahollifield · Accepted solution]

Start with Primary Admin Node.  After that the order doesn't matter, whatever is best for your individual deployment's HA strategy

[PradeepSingh · Accepted solution]

Agree to @ahollifield CLI gives better control. Although initiating from GUI is easiest, but you don't have such monitor and control.