topic Licensing confusion in Network Access Control

Licensing confusion

Northy — Tue, 14 Jan 2020 20:45:43 GMT

Hi all,

I have attempted to understand licensing for the last couple of days but seem to be reading conflicting posts and documentation

We have ISE 2.4 with base licenses only currently.

We also have AnyConnect with Apex licenses that are using the ISE server to AuthN/AuthZ.

I have been asked to understand what would be required in order enable posture checking with ISE.

Do I need to have an AnyConnect Apex license as well as an ISE Apex license to match?

Also I don't really understand the consumption of licenses.

In the documentation, it states that a plus license is consumed before an apex license.

Does this mean i need to have an equal amount of plus and apex licenses to be able to use Apex functionality?

Im happy to read any docs if anyone has anything that is concise

Re: Licensing confusion

Karsten Iwen — Tue, 14 Jan 2020 22:13:10 GMT

For posturing, you need both the APEX license on the ISE and for AnyConnect. The ISE-license gives you the feature on the server-side, the AC license allows you to use the "better" endpoint agent. Without the AnyConnect APEX license, you still could use the legacy client.

This feature does not consume a PLUS license, you don't need to have one for posturing, but if you want to enable other feastures like profiling, you also need PLUS licenses.

Re: Licensing confusion

Northy — Wed, 15 Jan 2020 08:21:54 GMT

Thanks for clearing that up for me