topic Re: Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)? in Network Access Control

Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)?

markgully — Fri, 13 Jul 2018 16:02:41 GMT

Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)?

If I deploy VMs and match the hardware specs of a sns3515 we match a Large VM license. If I remove virtual CPUs to 6 to match the specs of a small VM license, ISE detects the profile as “ucsSmall”, which I’ve been told is not supported for ISE 2.4.

Background –

We have a new virtual ISE 2.4 deployment based off the “ISE-2.4.0.xxx-virtual-SNS3515-Small-200GBHD-16GBRAM-12CPU.ova”. We have ISE Virtual Machine Small licenses (R-ISE-VMS-K9), but when the new VMs are connected to smart licensing we’re getting the error that we need ISE Virtual Machine Large licenses.
My understanding is that the virtual appliance hardware specs must match the physical appliance specs to be supported (per various Cisco Live sessions including BRKSEC-3697). The OVA deployment fulfills this requirement and “show tech” lists the ISE profile as “sns3515”. This is all good, but we’re being pressed for Large VM licenses.
If I drop the virtual CPU count to meet the small VM license specs the ISE profile shows “ucsSmall”, which I don’t believe supports ISE 2.4.
Note, I’ve already identified that this is hitting the bug CSCvj86638…. I’m looking past that as we can deploy via ISO if there’s a supported option.

Thanks in advance.

Re: Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)?

hslai — Fri, 13 Jul 2018 16:11:17 GMT

We are addressing the VM licensing issue with CSCvk09597, currently planned for ISE 2.4 Patch 3.

Thus, I would NOT recommend reducing CPU or RAM especially if the deployment needing the additional resources.

Re: Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)?

markgully — Fri, 13 Jul 2018 16:31:07 GMT

Thanks hslai.

We're currently in the grace period for licensing (~40days go to). Can you provide an ETA for when this will be fixed? What are our options if this won't be resolved prior to our license expiring? We're looking to go-live with the service at the end of July and I'm trying to assess our options/impact.

PS - I can't see CSCvk09597. Would it be helpful for me to have TAC link my case to it?

Re: Is there a TAC/Cisco supported deployment running ISE 2.4 virtual machines with a Small VM license (R-ISE-VMS-K9)?

hslai — Fri, 13 Jul 2018 17:15:15 GMT

Other than the nagging alarms, ISE 2.4 is not currently enforcing VM licenses, so it's ok to ignore them.

It's too early to know a good approximate CCO date for Patch 3 but we expect it in 2 ~ 3 months. If it not acceptable to you or your management, then please ask TAC to request a hot patch.

I will discuss with our team about publishing info on CSCvk09597.