topic Re: question about new VM node license in IE 2.4 in Network Access Control

question about new VM node license in IE 2.4

robohara — Mon, 09 Jul 2018 17:35:19 GMT

Hi,

In reviewing the release notes for ISE 2.4, it looks like they’ve added a new license feature – each VM now requires a “VM node” license:

Licenses for VM nodes

Cisco ISE is also sold as a virtual appliance. For Release 2.4, it is recommended that you install appropriate VM licenses for the VM nodes in your deployment. You must install the VM licenses based on the number of VM nodes and each VM node's resources such as CPU and memory. Otherwise, you will receive warnings and notifications to procure and install the VM license keys in Release 2.4, however, the services are not interrupted.

VM licenses are offered under three categories—Small, Medium, and Large. For instance, if you are using 3595 equivalent VM node with 8 cores and 64 GB RAM, you might need a Medium category VM license, if you want to replicate the same capabilities on the VM. You can install multiple VM licenses based on the number of VMs and their resources as per your deployment requirements.

VM licenses are Infrastructure licenses, therefore, you can install VM licenses irrespective of the endpoint licenses available in your deployment. You can install a VM license even if you have not installed any Evaluation, Base, Plus, or Apex license in your deployment. However, in order to use the features enabled by the Base, Plus, or Apex licenses, you must install the appropriate licenses.

After installing or upgrading to Release 2.4, if there is any mismatch between the number of deployed VM nodes and installed VM licenses, alarms are displayed in the Alarms dashlet for every 14 days. Alarms are also displayed if there are any changes in the VM node’s resources or whenever a VM node is registered or deregistered.

VM licenses are perpetual licenses. VM licensing changes are displayed every time you log in to the Cisco ISE GUI, until you check the "Do not show this message again" check box in the notification popup.

If you have not purchased any ISE VM license before, refer to the ISE Ordering Guide to choose the appropriate VM license to be purchased. If you have purchased ISE VM licenses with no Product Authorization Key (PAK) associated, you can request VM PAKs by reaching out to ise-vm-license@cisco.com with Sales Order numbers that reflect the ISE VM purchase. This request will be processed to provide one medium VM license key for each ISE VM purchase you made in the past.

So, I went into CCW to find these licenses, and I priced out 6 of these in the SMALL size…

Here is what I came up with… see CCW Estmate ID CF83025440IP - shared with anyone who has the ESTIMATE ID/

Is this correct, because as you can see in the description, it is not referred to as a ‘node license’.

Please confirm or correct me?

Rob

Re: question about new VM node license in IE 2.4

kvenkata1 — Mon, 09 Jul 2018 18:31:44 GMT

Please consult the updated ISE ordering guide for the right SKUs.

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

- Krish

Re: question about new VM node license in IE 2.4

Istvan Matyasovszki — Mon, 06 Aug 2018 14:56:52 GMT

Hi all,

What is the role, projected use of these licenses ? I am asking as the documentation is not clear about it and I have a customer who would need to go into production with ISE 2.4 but due to budgeting schedule will not be able to purchase the VM Node licenses till about one or two months after going into production (the licenses are not being enforced for now afaik). Does for example TAC condition support to the customer on the basis / presence of these licenses ?

Thank you
Istvan

Re: question about new VM node license in IE 2.4

Nidhi — Tue, 07 Aug 2018 10:02:21 GMT

I suggest you contact the Licensing team to get some details here.

Re: question about new VM node license in IE 2.4

Istvan Matyasovszki — Tue, 07 Aug 2018 10:23:08 GMT

Hi,

I did do that but I have not received the necessary details and information, hence the reason for sharing my question in this forum.

Thank you and hope someone can shed some light on this topic.

Istvan

Re: question about new VM node license in IE 2.4

yshchory — Tue, 07 Aug 2018 21:10:41 GMT

Rob,

I can't seem to be able to access the estimate. In any case, assuming you used the SKUs:

R-ISE-VMS-K9=, R-ISE-VMM-K9= or R-ISE-VML-K9=, you should be fine.

What this licenses enables you is to run a single VM of ISE. The difference between them is size / resource wise. Refer to table 1 on the ISE Ordering Guide to understand the different resource allocations you need per VM.

Yuval

HTH,

Yuval

Re: question about new VM node license in IE 2.4

yshchory — Tue, 07 Aug 2018 21:14:13 GMT

Istvan,

Customer are required to buy licenses for their deployment prior to running them. Be aware that while evaluation licenses are available, support eligibility is probably impacted when these are used (read: they will not be eligible for support if sometimes go wrong).

Bottom line is that the customer should not go production unless they are compliant.

Yuval

Re: question about new VM node license in IE 2.4

Istvan Matyasovszki — Wed, 08 Aug 2018 05:55:44 GMT

Hi Yuval,

Thank you for your help, will relay the information to the customer and work with them to make sure

all VM Node Licenses are installed before going into production.

Istvan