ISE 2.4 Licensing Clarification

Alex Pfeil — Wed, 22 May 2019 10:45:10 GMT

I currently have profiling groups to profile devices, say Computers, Scanners, and Phones. These groups have Identity Groups which were created with a parent group of Profiled. They are also a member of a Logical Profile called All Devices. After a device is profiled, I statically assign the device so that it no longer uses a profiling license. I have been doing this for over a year; when the profiling Plus licenses go over their limits, we statically assign devices and the Plus licenses come back down by the next day.

We just recently started doing Wired 802.1X\MAB. The plan was to do the profiling the same way that we have completed it with wireless. However, for Wired MAB, when I statically profile a device and it authenticates to the network, it uses a profiling license. If I move the device to an Identity Group that does not have Profiled as it's Parent group, it does not consume a license.

Is that a bug with 2.4, or is it specifically supposed to be like that?

Why is the behavior different for groups if I am doing wireless 802.1x versus wired MAB?

I was always under the impression that if I statically assign a device, it would not use a Plus license.

Re: ISE 2.4 Licensing Clarification

Jason Kunst — Wed, 22 May 2019 11:38:24 GMT

Static assignment should not consume a plus license. There have been some bugs found in 2.4 around that.

I don’t know why the behavior is different as I agree it shouldn’t be.

I would suggest opening tac case for further analysis if still issues.

topic ISE 2.4 Licensing Clarification in Network Access Control

ISE 2.4 Licensing Clarification

Re: ISE 2.4 Licensing Clarification