ISE Device Admin Licensing

Rob4 — Tue, 29 Oct 2019 13:29:06 GMT

Hi all, let's say I have a 30 node deployment and I purchase 10 Device Admin licenses. What happens when I enable Device Admin services on the 11th node? Will I get an Out of Compliance warning? Will it serve TACACS on all 11, or just the first 10 then I enabled?

Appreciate any insight

Re: ISE Device Admin Licensing

Arne Bier — Wed, 30 Oct 2019 10:54:21 GMT

Interesting question. What version of ISE?

In the old days you could only purchase a single Device Admin License and that entitled you to 50 PSNs.

Now it's become per PSN. You will get a license violation (I have seen it in Smart Licensing on ISE 2.4 systems) but I don't know how and when it gets enforced. If you managed to purchase the old SKU then you can get it converted to a 50 PSN in the new licensing model. But all new SKUs are purchased per PSN.

Enabling Device Admin is just a checkbox on the PSN. I have not tried to enable it on a system that has no eval, but only has Base licenses for example. It might be that this option is greyed out and/or the menu items to configure Device Admin are hidden. But if you already have a licensed PSN, and you go over the limit, then the menu's cannot be hidden. I suspect ISE will simply inform you about license violation.

There's probably a document out there that tells you what will happen if you violate the license (after x number of days etc.). VM License violation is still not enforced in 2.6.

topic ISE Device Admin Licensing in Network Access Control

ISE Device Admin Licensing

Re: ISE Device Admin Licensing