topic Re: ISE licensing Error in Network Access Control

ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 22:53:52 GMT

Trying to license my new ISE node installation and get an error:

Invalid license file, unknown feature type 'ISE VM MEDIUM' detected.

Anyone know what this means and what i need to fix it?

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 22:58:06 GMT

What ise version?

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:00:33 GMT

2.2 path 10.

ISE-VM-K9 V01

I used the ISE-2.2.0.470-virtual-200GB-SNS3415.ova to deploy.

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:06:29 GMT

VM licenses are only applied in ISE 2.4
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/release_notes/b_ise_24_rn.html

Licenses for VM nodes

Cisco ISE is also sold as a virtual appliance. For Release 2.4, it is recommended that you install appropriate VM licenses for the VM nodes in your deployment. You must install the VM licenses based on the number of VM nodes and each VM node's resources such as CPU and memory. Otherwise, you will receive warnings and notifications to procure and install the VM license keys in Release 2.4, however, the services are not interrupted. Starting from Cisco ISE 2.4, you can now manage your VM licenses.

VM licenses are offered under three categories—Small, Medium, and Large. For instance, if you are using 3595 equivalent VM node with 8 cores and 64 GB RAM, you might need a Medium category VM license, if you want to replicate the same capabilities on the VM. You can install multiple VM licenses based on the number of VMs and their resources as per your deployment requirements.

VM licenses are Infrastructure licenses, therefore, you can install VM licenses irrespective of the endpoint licenses available in your deployment. You can install a VM license even if you have not installed any Evaluation, Base, Plus, or Apex license in your deployment. However, in order to use the features enabled by the Base, Plus, or Apex licenses, you must install the appropriate licenses.

After installing or upgrading to Release 2.4, if there is any mismatch between the number of deployed VM nodes and installed VM licenses, alarms are displayed in the Alarms dashlet for every 14 days. Alarms are also displayed if there are any changes in the VM node’s resources or whenever a VM node is registered or deregistered.

VM licenses are perpetual licenses. VM licensing changes are displayed every time you log in to the Cisco ISE GUI, until you check the "Do not show this message again" check box in the notification popup.

If you have not purchased any ISE VM license before, refer to the ISE Ordering Guide<> to choose the appropriate VM license to be purchased. If you have purchased ISE VM licenses with no Product Authorization Key (PAK) associated, you can request VM PAKs by reaching out to ise-vm-license@cisco.com with Sales Order numbers that reflect the ISE VM purchase. This request will be processed to provide one medium VM license key for each ISE VM purchase you made in the past.

The following table shows the minimum VM resources by category:

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:27:09 GMT

Ok I don’t understand. Are we maybe saying that my license is for an install of ise from an iso?

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:30:29 GMT

For 2.2 they are entitlement and kept offline. VM licenses are not installed on ISE until ISE 2.4.

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:33:15 GMT

So the .lic files I generated in the licensing portal tying a pak to an ISE serial is irrelevant? How do I know it’s licensed correct esp the secondary node ?

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:33:29 GMT

The only licenses are installed on ISE are the ones mentioned in the ordering guide (base, plus, apex)
https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:35:29 GMT

Licenses such as base, plus apex are only installed on the primary admin
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:37:57 GMT

So my primary has base and device admin so when I added the secondary to the “cluster” it’s licensed?

very confusing

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:41:52 GMT

Base, plus apex device admin are all installed on the PAN for the whole deployment
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:46:53 GMT

So when I get my apex, install it in primary pan. So do I need to assign the pak to the secondary in licensing portal on Cisco site?

Re: ISE licensing Error

Jason Kunst — Wed, 14 Nov 2018 23:49:29 GMT

This is explained in the guide, please read manage traditional license
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html#id_24977

Re: ISE licensing Error

Steven Williams — Wed, 14 Nov 2018 23:53:50 GMT

Ya so looks like I need to revert the secondary to standalone and install the license as it is a admin node also in an HA pair.

Re: ISE licensing Error

Jason Kunst — Thu, 15 Nov 2018 00:18:31 GMT

I’m very confused I would recommend contacting the tac for further support

Re: ISE licensing Error

Steven Williams — Thu, 15 Nov 2018 00:31:06 GMT

Licenses are uploaded to the Primary Administration Node (PAN) and propagated to the other Cisco ISE nodes in the cluster. Licenses are centrally managed by the Administration node, the other nodes do not require separate licenses. If you have two Administration nodes deployed in a high-availability pair, you must ensure that each of them have the same license capabilities. Generate licenses with both UDIs and then add the licenses while each node is in a standalone or primary state.

Is this not an HA pair of nodes BOT being admin nodes? So isn't that saying before I pair them I need to have the licensing on both before I register them?

Re: ISE licensing Error

Jason Kunst — Thu, 15 Nov 2018 00:34:31 GMT

No the license is installed to the primary admin

The secondary admin is required simply for failover

When you generate your license you provide the primary and secondary udi and this is needed when failover happens so the new primary is properly licensed in the deployment

Re: ISE licensing Error

Steven Williams — Thu, 15 Nov 2018 00:40:07 GMT

Ok now that makes sense! And tells me when I was registering my licensing what the "secondary" fields were for, that i didn't fill in. I wish everything was just licensed via internet based on serial number, make it so much easier.