Ivanti Connect Secure Gateway Management

26 min

Patch lifecycle managementPatch lifecycle management

Removing Ivanti Connect Secure Gateway

Introduction

An admin can manage the ICS Gateway/Cluster with the following operations:

Restart Services: Kills all processes and restarts the Gateway/Cluster. The Gateway/Cluster is available again after a few minutes. See Restarting Services.

Reboot Gateway: Reboots the Gateway. The Gateway is available again after a few minutes. See Rebooting ICS Gateway/Cluster.

Reboot Cluster: Reboots all nodes in the Cluster. See Rebooting ICS Gateway/Cluster.

Rollback to <version>: Reverts the registered Gateway virtual machine instance to the specified version. See Rolling Back a Gateway/Cluster.

Rollback Cluster: Reverts the cluster instance to the previous version. See Rolling Back a Gateway/Cluster.

Upgrade to <version>: Upgrades the registered Gateway virtual machine instance to the specified version. See Upgrading a Gateway and Cluster

Upgrade to <version> Cluster: Upgrades all the nodes in the Cluster to the specified version. See Upgrading a Gateway and Cluster.

Delete Gateway: Removes the Gateway record. See Removing Ivanti Connect Secure Gateway.

Configure Integrity Scanner: Scans the system periodically to check for any integrity anomalies.

Upgrade multiple Gateways/Clusters to new version: Upgrades multiple Gateways/Clusters to the specified version. See Upgrading Multiple Gateways and Clusters.

Patch lifecycle management: Provides controlled patch lifecycle for gateways enabling seamless patch upgrades, rollback and removal while maintaining operational continuity. See Patch Lifecycle ManagagementPatch Lifecycle Managagement.

The available menu options vary depending on whether the selected Gateway is registered and connected to the NSA.

Viewing ICS Gateway/Cluster Details

To view the list of ICS Gateways and Clusters:

Log in to the Ivanti Neurons for Secure Access portal as a Tenant Admin. See Logging in to Ivanti Neurons for Secure Access.

Use the Gateway Switcher and select Ivanti Connect Secure.

From the Ivanti Connect Secure menu, click the Gateways icon, then select Gateways > Gateways List. The Gateways List page is displayed showing a list of standalone ICS Gateways and Cluster nodes.

Use the page controls at the bottom to select the number of log records/rows per page, or select a specific page.

Use the Search bar to filter the results list. For example, to show only those Gateways that match a search string.

Use the Group by option and select the field type (Gateway Type, Connection status, Version or Region) to view the table information in groups.

Use the Refresh icon () to manually refresh the data.

Use the Expand all / Collapse all icon () provided in the Gateways List page to expand / collapse the Clusters and Gateways lists.

The Gateway management functions can be performed only if the status of the Gateway is green.

To view the details of a specific Gateway:

In the All Gateways page, double-click the required Gateway from the Standalone Gateways list. The Gateway Overview page is displayed showing the Gateway Status, Version, Registration State, and last Updated time.

Click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway.

To view the details of an Active-Active Cluster:

In the Gateways List page, double-click the Active-Active Cluster from the list. The Gateway Overview page is displayed showing the Model, Cluster Name and Configuration of the Cluster.

Click the context menu icon present at the top-right of the page to access the options applicable to the selected Cluster.

To view the details of an Active-Passive Cluster:

In the Gateways List page, double-click Active-Passive Cluster from the list. The Gateway Overview page is displayed showing the Model, Cluster Name, Configuration, External and Internal VIP Owner, External and Internal VIP IPV4/IPV6 of the Cluster.

Click the context menu icon present at the top-right of the page to access the options applicable to the selected Cluster.

Creating an ICS Cluster

Clusters define a collection of Gateways that operate as if they were a single machine. A cluster pair is used to refer to a cluster of two units and a multiunit cluster refers to a cluster of more than two units. Once two or more units are joined in a cluster, they act as one unit.

To create an ICS Cluster:

In the Gateways List page, click the Create drop-down list.

From the Gateway types list, select ICS Cluster.

Select the ISA Model.

Select the Gateway Version.

Enter a unique Cluster Name. Maximum 19 characters, only alphanumeric and hyphens are allowed between characters.

Select a member node and click Add to add the nodes.

Enable Configuration Only Cluster to limit data transfer between cluster nodes. User and session specific limits are only enforced on the node and not across the cluster.

Click Create Cluster.

After creating a cluster from NSA, add subsequent nodes to the cluster from NSA only.

Restarting Services

To restart services:

In the Gateway Overview page, click the context menu icon at the top-right to access the options applicable to the selected Gateway or Cluster.

Select the Restart Services option. The Gateway/Cluster is available again after a few minutes.

Rebooting ICS Gateway/Cluster

To reboot ICS Gateway:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway.

Select the Reboot Gateway option. The Gateway is available again after a few minutes.

To reboot ICS Cluster:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected A/A or A/P Cluster.

Select the Reboot Cluster option. The Cluster is available again after a few minutes.

Rolling Back a Gateway/Cluster

Your ICS Gateway/Cluster can be rolled back to a previously-installed version through the Tenant Admin Portal. You might want to return to an earlier version if, for example, you encounter an unforeseen issue with a newly-upgrading Gateway instance, or for testing purposes.

You can roll back to a version only where that Gateway instance has been previously upgraded through the Tenant Admin Portal, and only to the previously-installed version.

To roll back a Gateway to an earlier version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a rollback function is available for this Gateway, a corresponding link is displayed in the drop-down menu:

Select the Rollback to <version> link. As the rollback process starts, your Gateway remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Gateway reboots and becomes unavailable for a short time. If the procedure is successful, the new software version is displayed in the Gateway Overview page.

To roll back a Cluster to the previous version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Cluster. If a rollback function is available for this Cluster, a corresponding link is displayed in the drop-down menu:

Select the Rollback Cluster link. As the rollback process starts, your Cluster remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Cluster reboots and becomes unavailable for a short time. If the procedure is successful, the new software version is displayed in the Gateway Overview page.

Upgrading a Gateway and Cluster

Ivanti periodically creates and releases new software versions to address updates and issues, and to improve performance. As new version packages become available, you can trigger an upgrade for your Gateway/Cluster through the NSA to take advantage of the updates available in the new version.

Upgrading to ICS Gateway version 25.1.0.0 is supported only from ICS Gateway version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances. Upgrades from earlier ICS Gateway versions (ICS 22.7R2.x and below) to ICS 25.1.0.0 are not supported.

To upgrade a Gateway to a higher version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If the upgrade function is available for this Gateway, a corresponding link is displayed in the drop-down menu:

Select the Upgrade to <version> link.

In some cases, there might be more than one version available. Select the version you want, or contact your support representative for details.

As the upgrade process starts, your Gateway remains operating on the current version and continues to serve traffic. After the upgrade to new version, the Gateway reboots and becomes unavailable for a short time. If the procedure is successful, the upgrade task is marked with a status of “Success” and the new software version is displayed in the Gateway Overview page.

Cluster upgrades to ICS Gateway version 25.1.0.0 are not supported.

To upgrade a Cluster to a higher version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Cluster. If the upgrade function is available for this Cluster, a corresponding link is displayed in the drop-down menu:

Select the Upgrade to <version> Cluster link.

In some cases, there might be more than one version available. Select the version you want, or contact your support representative for details.

As the upgrade process starts, your Cluster remains operating on the current version and continues to serve traffic. After the upgrade to new version, the Cluster reboots and becomes unavailable for a short time. If the procedure is successful, the upgrade task is marked with a status of “Success” and the new software version is displayed in the Gateway Overview page.

Upgrading Multiple Gateways and Clusters

This feature allows you to upgrade one or more gateways and clusters in a tenant with a selected version.

- Upgrading to ICS Gateway version 25.1.0.0 is supported only from ICS Gateway version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances. - Note that cluster upgrades are not supported. Additionally, upgrades from earlier ICS Gateway versions (ICS 22.7R2.x and below) to ICS 25.1.0.0 are not supported.

Upgrading Gateways and Clusters with Ivanti Secure Access Client

To upgrade one or more Gateways and Clusters with an Ivanti Secure Access Client package newer version:

Log in to the Ivanti Neurons for Secure Access portal as a Tenant Admin. See Logging in to Ivanti Neurons for Secure Access.

Use the Gateway Switcher and select Ivanti Connect Secure.

Select Administration > Upgrade > Installation Packages.

In the Installation Packages page, select the Ivanti Secure Access Client tab. Lists of available Ivanti Secure Access Client packages appears per OS, namely, Cross-Platform, Windows, MacOS and Linux. The list contains ISAC packages common to ICS and ZTA , and ISAC packages specific to ICS.

Select any of the OS tabs to see the Ivanti Secure Access Client packages. This is the version of the Ivanti Secure Access Client software that you want users to have on their device.

As each user next logs into Ivanti Secure Access Client on their device, if their software is at a different version, Ivanti Secure Access Client provides a prompt to the user to change to the version you selected in NSA.

After the Client package download starts from NSA to ICS Gateway, any other operations in NSA, for example a Role or Realm creation and any configuration change, do not work unless the download is complete. After the successful download, config creations or modifications appear.

Upgrading Gateways and Clusters with ESAP

Downloading an ESAP Package

Download the Endpoint Security Assessment Plug-in from the Software Download Portal to your computer. You need to have the login credentials to access the portal.

Open the Software Download Portal page.

Click the Software tab.

Navigate to the ESAP release you want, and click the link to download the package file to accessible local storage.

Uploading the ESAP Package

To upload the ESAP package that you downloaded from Software Download Portal:

Select Administration > Upgrade > Installation Packages.

In the Installation Packages page, select the ESAP tab.

Click the Upload ESAP file box.

Browse and select the latest ESAP package that you want to upload and then click Import. After successful upload to NSA, the ESAP package gets listed in the ESAP packages page.

You can upload only one ESAP package.

Upgrading with ESAP

To upgrade one or more Gateways and Clusters to a newer ESAP package version:

Select Administration > Upgrade > Installation Packages.

In the Installation Packages page, select the ESAP tab.

Select the required build version from the list and click Select Gateways/Clusters to Upgrade.

In the Select Gateways / Clusters for Upgrade dialog, from the Select Gateways drop-down list, select one or more Gateways.

The UI shows the applicable Gateways/Clusters running on version 21.12 and above.

From the Select Clusters drop-down list, select one or more Clusters.

The Select Gateways and Select Clusters list shows only those Gateways and Clusters that have lower versions than the selected version.

Click Upgrade. The upgrade task is scheduled, and a notification is displayed in the logs.

NSA deletes all the existing ESAP packages from the ICS Gateway after the upgrade and retains only the upgraded ESAP version.

Upgrading Gateways and Clusters with a New Gateway/Patch Version

The Gateway Upgrade system manages firmware upgrades and patches for Ivanti ICS gateways. It supports:

Full upgrades: Major/minor version changes (e.g., 22.8R2 → 25.1.0, or 25.1.2 → 25.1.4)

Scheduled upgrades: Planned upgrades at a specific date/time

Auto-upgrades: Automatic upgrades during configured maintenance windows

To upgrade one or more Gateways and Clusters:

Select Gateways > Multinode Configuration > Gateway Upgrade. The Gateways Upgrade page shows the list of Gateways. You can sort the list based on gateway name or connection status. To change the fields displayed, use the icon. To trigger the advanced filter selection, use the icon.

Upgrade Status column shows the following statuses:

Up to date

Upgrade scheduled

Download scheduled

Ready to upgrade (check box beside the Gateway name is enabled)

Install (option that appears once the package is downloaded. Click Install to upgrade the Gateway.)

Select one or more Gateways with same version from the list and click Upgrade. The Upgrade dialog is displayed.

From the Eligible Version list, choose the ICS version that you want to upgrade to.

From the Upgrade Action list, choose appropriate option from the following: Upgrade now, Download now, Schedule download, or Schedule upgrade, and follow the instructions.

Click Apply. The Overview page shows the actions related to Upgrade now or Download now options.

To view the scheduled actions, select the Scheduled tab.

In the Tenant Admin Logs page, see the logs generated for the Stage/Upgrade activities: Sample Tenant Admin Logs page

Patch Lifecycle Management

Patch versions are cumulative and its lifecycle management like upgrade, rollback and removal workflows are supported. It enables faster upgrades and supports both standalone gateways and multi-node clusters.

To upgrade a Gateway to a higher patch version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If the upgrade function is available for this Gateway, a corresponding link is displayed in the drop-down menu:

Select the Upgrade to <version> (Patch) link.

To roll back a Gateway to an earlier patch version:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a rollback function is available for this Gateway, a corresponding link is displayed in the drop-down menu:

Select the Rollback to <version> (Patch) link. As the rollback process starts, your Gateway remains operating on the current version and continues to serve traffic. After the earlier version is reinstated, the Gateway reboots and becomes unavailable for a short time. If the rollback procedure is successful, the previous software version is displayed in the Gateway Overview page.

To remove a patch package:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable for the selected Gateway. If a remove patch function is available for this Gateway, a corresponding link is displayed in the drop-down menu:

Select the Remove Patch link. As the removal process starts, your Gateway remains operating on the current version and continues to serve traffic. If the removal procedure is successful, the base version is displayed in the Gateway Overview page.

Removing Ivanti Connect Secure Gateway

To remove Ivanti Connect Secure Gateway:

In the Gateway Overview page, click the context menu icon present at the top-right of the page to access the options applicable to the selected Gateway.

Select Delete Gateway. The selected Gateway is removed from the list of Gateways.