topic Re: ISE Licensing in Network Access Control

ISE Licensing

atiye.bigdeli — Tue, 14 Aug 2018 08:17:52 GMT

Hi friends.

I want to deploy the cisco ise for 1200 client. we need posture and profiling. I think that the licenses that are required are:

R-ISE-VMM-K9=

L-ISE-BSE-P4

L-ISE-PLS-1Y-S4

L-ISE-APX-1Y-S4

L-ISE-TACACS-ND=

and for any connect

Term LicenseBanding SKU

L-AC-PLS-LIC=	L-AC-PLS-5Y-S5
L-AC-APX-LIC=	L-AC-APX-1Y-S5

I have some question:

1- I want to use HA deployment and run two cisco ISE VM. the HA need per license for each vm? or only one license is required?

2- for Tacacs license, is this license, count base or one license for each VM?

3-I want to use Any Connect for posturing, do I need plus license in addition to Appex license?

Re: ISE Licensing

Cory Peterson — Tue, 14 Aug 2018 10:30:03 GMT

R-ISE-VMM-K9=	Need one for each VM you are going to Deploy.
L-ISE-BSE-P4	Need as many as the total concurrent endpoints
L-ISE-PLS-1Y-S4	Only need the amount equal to the total amount of endpoints you plan on profiling (It only counts a license when you using profiling to make a policy decision)
L-ISE-APX-1Y-S4	Only need the amount equal to the total amount of endpoints you plan on posturing
L-ISE-TACACS-ND=	Need 1 per VM that will do TACACS Authentications (Assuming you are deploying 2.4)

I would also recommend going with a longer term than 1 year, unless you have a specific reason.

For Anyconnect, you only need Anyconnect Plus Licensing to support ISE Posture, ISE NAM, VPN.

With anyconnect you only need Plus or Apex, not both. Apex Covers all Plus features plus the Apex features.

Re: ISE Licensing

atiye.bigdeli — Wed, 15 Aug 2018 05:09:59 GMT

Thank you for your reply.

do I need one L-ISE-TACACS-ND= per VM even I do HA with these two VM?

Best Regards

Re: ISE Licensing

atiye.bigdeli — Wed, 15 Aug 2018 05:38:38 GMT

L-ISE-BSE-P4	Need as many as the total concurrent endpoints
L-ISE-PLS-1Y-S4	Only need the amount equal to the total amount of endpoints you plan on profiling (It only counts a license when you using profiling to make a policy decision)
L-ISE-APX-1Y-S4	Only need the amount equal to the total amount of endpoints you plan on posturing

Do you mean, I shoud order 1200 L-ISE-BSE-P4 and L-ISE-PLS-1Y-S4 and L-ISE-APX-1Y-S4?

or only one?

because in cisco document said, for example per L-ISE-PLS-1Y-S4 contain 1000 to 2499 sessions.

best regards

Re: ISE Licensing

Cory Peterson — Wed, 15 Aug 2018 12:27:19 GMT

Yes, you need one Device Admin License per Node/VM.

The Licenses are sold in blocks. Work with a Cisco Partner to order the items, they can get you a quote.

Re: ISE Licensing

Charlie Moreton — Wed, 15 Aug 2018 15:20:44 GMT

ISE Posture Module is only available with the AnyConnect Apex License, not Plus

Re: ISE Licensing

Cory Peterson — Wed, 15 Aug 2018 15:27:59 GMT

Yes, that is correct. I misspoke on that point, APEX is needed for Posture.

Re: ISE Licensing

Damien Miller — Wed, 15 Aug 2018 16:42:33 GMT

Licenses for 2.4 are sold in ranges, for example, you add the parent sku then select the exact quantity of P1 to p11. There are different parent and sub sku's for base, plus, and apex.

Ex. If you wanted to order 723 base licenses.
L-ISE-BSE-PLIC x 1
L-ISE-BSE-P3 - x 723

Re: ISE Licensing

mhapsekar.suyog — Sun, 10 Nov 2019 10:54:31 GMT

Hello Miller,

Could you please address my below query, Thanks in advance.

We have procured ISE 3615 with 249 user session licenses, license part codes are as below:

L-ISE-BSE-PLIC= ISE Base Licence Qty- 1
L-ISE-BSE-P1 Cisco ISE Base License - Sessions 100 to 249 Qty-249

Now we want to extend ISE capacity from 249 to 2499 users session, then do we need to add all below part codes in BoM(bill of material)?

L-ISE-BSE-P2 Cisco ISE Base License - Sessions 250 to 499 Qty- 499
L-ISE-BSE-P3 Cisco ISE Base License - Sessions 500 to 999 Qty- 999
L-ISE-BSE-P4 Cisco ISE Base License - Sessions 1000 to 2499 Qty- 2499

Adding only 'L-ISE-BSE-P4' Cisco ISE Base License - Sessions 1000 to 2499 Oty- 2499 is enough?

IF i enable 'L-ISE-BSE-P4' Cisco ISE Base License - Sessions 1000 to 2499 , what happens to my earlier 249 session licenses, will it get added? 2499 + 249 = 2748 session licenses?

Regards,

Re: ISE Licensing

Damien Miller — Sun, 10 Nov 2019 15:55:40 GMT

Your existing 249 base licenses will remain valid when you purchase more licensing. ISE licenses are banded, so based on the order quantity you select a different band, and all licenses are purchased with that specific band. If you want 2499 total licenses you would only have to order 2200 more in the P4 band.

ex. If you order 2500 additional base licenses, you would do that via the P5 band. If you order 2200 more it will be in the P4 band. Band licensing = volume discounts.

Re: ISE Licensing

mhapsekar.suyog — Mon, 11 Nov 2019 03:05:59 GMT

Thanks a lot Miller.