topic Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs in Network Access Control

ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

cfitzgerald — Wed, 15 Jan 2020 17:35:52 GMT

We have a fleet of 3650 switches running Lanbase license. I just discovered today that the Device Profiling (Device Sensor) features of ISE require the IP Base license on the switches. I am trying to find out what other features of ISE require IP Base, but I can't find what I need. Does anybody have any ideas? Thanks.

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

Mike.Cifelli — Wed, 15 Jan 2020 20:44:32 GMT

See here: https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-device-support-tables-list.html

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

cfitzgerald — Wed, 15 Jan 2020 20:52:10 GMT

HI @Mike.Cifelli,

Thanks for your response, but I've looked at that document before. It confirms that the 3650 switch is compatible with all ISE features, but it does not differentiate between a switch with LAN Base license vs IP Base (or higher).

ISE Device Profiling requires IP Base. But what about TrustSec? Or Posturing?

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

Damien Miller — Wed, 15 Jan 2020 21:28:27 GMT

I don't think you will find a comprehensive list because feature sets have always varied by model. I've never seen one at least.

If you look at the TrustSec matrix, you can see what I'm talking about. In general though, trustsec is a feature found in ip base/network advantage/dna advantage. Some exceptions on the ends, ex. ie series switches, 2960's.
https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/software-platform-capability-matrix.pdf

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

Greg Gibbs — Wed, 15 Jan 2020 22:11:32 GMT

I could not find this information in public documentation, but I did find an previous TAC case in which the TAC engineer confirmed the following:

"NAC when used for posture flow, requires DACL configuration on the ISE. The DACLs are not applied on the switch interfaces if the switch uses LAN base license."

TrustSec also requires the IP Base feature set as per the Platform and Capability Matrix

As such, you would need to upgrade to the IP Base license to take advantage of the more advanced ISE features.

Cheers,

Greg

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

cfitzgerald — Thu, 16 Jan 2020 17:23:07 GMT

DACL seems like one of the most basic features of ISE, since it is required for any meaningful application of an AuthZ policy result.

I have been unable to find any reference to DACL in the Feature Navigator for the 3650 Platform.

Re: ISE features matrix with IOS Lan Base vs IP Base licensing on NADs

Damien Miller — Thu, 16 Jan 2020 18:08:09 GMT

While I can't speak to the feature navigator, I am 100% on DACLs being supported on 3650's.