topic Re: ISE licensing and ordering guide in Network Access Control

ISE licensing and ordering guide

raksec — Thu, 01 Aug 2019 10:38:03 GMT

Hello,

I am working on a requirement where customer is having 12K endpoints out of which 5K are laptop/desktop and rest 7K are non-dot1x devices (IP Phones, printers etc). For 5K laptop/desktop they want to do posture and for the rest 7K they wanna have AAA and profiling. Would it be wise to advise 12K base licenses, 7K plus licenses and 5K apex licenses?

I am a bit confused while looking at plus licensing in ordering guide which mentions the following "For all Plus features that do not directly consume sessions, it is required to still match the number of licenses with the number of Base licenses in the deployment."

Does it require to have the same number of base and plus licenses?

Thanks,

Rakesh Kumar

Re: ISE licensing and ordering guide

fmicucci1 — Thu, 01 Aug 2019 11:14:06 GMT

Hi Rakesh,

That's correct for features that do not consume licenses.

For example "Cisco TrustSec and ACI integration" require a Plus license but at the same time doesn't consume any, so how many Plus license I will need for that feature? The answer is that you will need to match the Base license number.

So this rule applies any time you need to enable a feature that per se doesn't consume a license.

From page 21 you can check the features that consume License or not:

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

Hope this makes sense.

Regards,

Fabrizio

Re: ISE licensing and ordering guide

raksec — Thu, 01 Aug 2019 12:33:01 GMT

Thanks Fabrizio.

To be very specific to my query, could you suggest on below requirement?

Customer is having 12K endpoints out of which 5K are laptop/desktop and rest 7K are non-dot1x devices (IP Phones, printers etc). For 5K laptop/desktop they want to do posture and for the rest 7K they wanna have AAA and profiling. Would it be wise to advise 12K base licenses, 7K plus licenses and 5K apex licenses?

Re: ISE licensing and ordering guide

fmicucci1 — Thu, 01 Aug 2019 13:01:46 GMT

Hi Rakesh,

Apologies if my explanation wasn't really clear.

Ok let's take the Apex license away of the equation as this rule doesn't apply to it (of the same number for Base and Apex) and let's focus on the Base and Plus license:

From the ordering guide, the Plus features that does not consume license are:

PassiveID (Non-Cisco Subscribers)
Profiler feed service
My Devices portal* and NSP
Context sharing
Endpoint Protection Services (EPS)
Cisco TrustSec and ACI integration

If you require any of the above you will need to match the Base and Plus licenses (same number). In your specific case probably check if you need the 'Profiler feed service' for example. If none of the above is required then you can conveniently split in 12k and 7k.

Regards,

Fabrizio

Re: ISE licensing and ordering guide

Charlie Moreton — Thu, 01 Aug 2019 14:31:24 GMT

Since you stated a need for Profiling, you would need the following licenses:

12,000 Base

12,000 Plus

5,000 Apex

This does NOT take into account VM licenses, Device Admin Licenses or AnyConnect Licenses (used for Posture).

Re: ISE licensing and ordering guide

raksec — Fri, 02 Aug 2019 05:15:01 GMT

Thanks Charlie. You have been very specific to the query.

Re: ISE licensing and ordering guide

raksec — Fri, 02 Aug 2019 05:15:50 GMT

Thanks Fabrizio. I understood it this time.