topic Re: ISE license count for radius authentication in Network Access Control

ISE license count for radius authentication

yongwli — Thu, 07 Mar 2019 09:01:28 GMT

Hi Team,

My customer has 100K endpoints, would use ISE as radius authentication and assigning IP address, user ID source is LDAP. They told us the endpoints won't send radius accounting, and seldom offline after onboard. How does ISE exhaust licenses in this senario?

Thanks

Re: ISE license count for radius authentication

ognyan.totev — Thu, 07 Mar 2019 09:55:49 GMT

Hi, no matter accounting ,every active radius session is 1 license after session disconnect is release the license .

Re: ISE license count for radius authentication

yongwli — Fri, 08 Mar 2019 08:33:54 GMT

If the device sends authentication request and get radius acceptance, but did not do any further logoff from a network, how does ISE revoke the license? Based on time expire? If yes, how long the radius session will be expired?

Re: ISE license count for radius authentication

ognyan.totev — Fri, 08 Mar 2019 08:57:36 GMT

The switch handle the session if device is active no matter lock or log off if the network adapter is active it will carry session ,only if device is turn off and adapter is off it will release the license because the switch will not see mac-address of the connected device or the name of device .....

Re: ISE license count for radius authentication

Nadav — Fri, 08 Mar 2019 17:31:12 GMT

These is a 5 day automatic endpoint purge for all active sessions. There was a bug awhile back when this wasn't enforced, but it was fixed for 2.4 P2.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi79632

As I understand it, each active session that doesn't get updated with accounting packets simply has 5 days before it's removed from ISE. At that point the BASE license should be freed up.

Re: ISE license count for radius authentication

yongwli — Mon, 11 Mar 2019 07:26:04 GMT

Thanks a lot!

Re: ISE license count for radius authentication

Damien Miller — Tue, 12 Mar 2019 02:51:02 GMT

This is correct, once ise hits five day session timeout it will free up licenses used for that endpoint.

There are a few bugs that also cause no license usage, but those arent readily advertised. Patch 6 fixed another license bug where expected counts mismatched.