topic Re: Importing/Uploading ISE License in Network Access Control

Importing/Uploading ISE License

dot1x — Tue, 11 Jul 2017 05:29:05 GMT

Hi Members,

Could someone assist me how to upload ISE license?

We are running ISE 1.3 and our licenses expired.

Cisco provided us with 60 days temporary licenses (Zip File).

Would restart be required once we import the license?

Re: Importing/Uploading ISE License

gbekmezi-DD — Tue, 11 Jul 2017 05:37:42 GMT

No, no restart required. You may have to log out and log back in if GUI elements need to be updated. Unzip the file and upload the license file(s) the zip file contains. The instructions are well documented. Step 5 here: http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2

George

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

Re: Importing/Uploading ISE License

dot1x — Tue, 11 Jul 2017 05:39:50 GMT

Thanks George.

I was concerned if I'd have to restart the box.

I'll give it a try and will update the post.

Thanks again.

Re: Importing/Uploading ISE License

Arne Bier — Tue, 11 Jul 2017 22:19:38 GMT

If you have a secondary PAN you need to apply the license to the Secondary as well (of course, the license has to be generated with the UDI of the Secondary, or else it doesn't match). And getting a license onto a Secondary PAN requires deregistering the node, apply license, and then registering again. At least that is my experience in ISE 2.1 & 2.2.

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 04:50:35 GMT

Hi Arne,

So we provided Cisco the Primary and Secondary PANs UDIs and they provided us with a license file.

Do we need to apply the same file to both Primary and Secondary PANs?

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 04:55:54 GMT

Adding and Upgrading Licenses

You can add a license only on a standalone or primary Administration ISE node. You can upgrade your existing evaluation license on or before the expiry of the 90-day evaluation period. You must install the base license before upgrading to the advance license.

It says we could add a license only on primary Admin Node.

Managing Licenses [Cisco Identity Services Engine] - Cisco Systems

Re: Importing/Uploading ISE License

Arne Bier — Fri, 14 Jul 2017 04:58:44 GMT

Hi Moin

yes indeed. The same license file(s) should contain the UDI details of both PAN nodes. You can open the files with a text editor to have a look (look for strings <PrimaryUDI> and <secondaryUDI>).

Applying licenses only works when the node is in STANDALONE or PRIMARY node. This means if your Secondary PAN is registered, it will be SECONDARY - you will have to deregister it first, apply license, and then register it again.

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 05:02:22 GMT

So here's what I should do?

1. De-register Secondary PAN.

2. Apply license to Primary PAN.

3. Apply license to Seondary PAN. (same license file)

4. Register Secondary PAN with Primary.

Re: Importing/Uploading ISE License

Arne Bier — Fri, 14 Jul 2017 05:08:04 GMT

Yup. Same file is used on both servers.

If you still have your eval licenses in place then I would delete those as well. Not sure if they automatically get removed from the system after 90 days (I would hazard a guess and say "no"). But mostly because having those eval licenses hanging around will enable features that you don't want/are entitled to (e.g. Assuming you only purchased BASE, then your menu options will change once you delete the eval Plus license). No idea what happens when eval licenses are left lying around after 90 days. Perhaps the menus will automatically adapt to the new (reduced) feature set.

cheers

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 05:11:34 GMT

We had wireless only license which expired. Cisco issued with 60 days temporary licenses to us.

L-ISE-W-S-500=

Also, I just checked the license file, it has exactly similar Primary and Secondary UDIs.

Should I check back with Cisco?

Re: Importing/Uploading ISE License

Arne Bier — Fri, 14 Jul 2017 05:20:58 GMT

Not sure about the circumstances of how you got those licenses - probably best to check with Cisco. If it's just a demo type license then I would not worry about it. But if it's for production, and you want your Secondary PAN to actually have a license for that instance when you have to fail over to it (usually that is not the best time to realise you have no license on your Secondary!!!) then get it sorted out now.

If it was a purchased licensed with a PAK, then in theory you can amend (re-home) a license in the Cisco licensing portal. I tried that and it didn't work - eventually opened a support ticket with Cisco licensing and they sorted it out pretty quickly.

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 05:23:35 GMT

Thanks mate, I'd check with Cisco as it's a production environment.

But the license file must have different UDIs for Primary and Secondary, right?

Re: Importing/Uploading ISE License

Arne Bier — Fri, 14 Jul 2017 05:33:45 GMT

Yes. When you try to upload the license to a PAN node, where the UDI does not match, then the license import will fail.

You can get the UDI from each PAN via CLI

show udi

Part of the license file looks like this

Re: Importing/Uploading ISE License

dot1x — Fri, 14 Jul 2017 05:39:15 GMT

Thanks mate, I'll check with Cisco and will update the post.

Re: Importing/Uploading ISE License

hslai — Fri, 14 Jul 2017 11:39:46 GMT

In an ISE deployment, just import the license files to the primary ISE node. There is no need to import them to the secondary admin node so please DO NOT deregister an ISE node solely to import licenses.

secondaryUDI

is optional and is there if you would like a redundancy for licensing in case later the 2nd PAN promoted to primary and in case you need to reimport the licence files for some reason.

Re: Importing/Uploading ISE License

dot1x — Sun, 16 Jul 2017 08:44:48 GMT

Is this true for ISE 1.3 as well?

If we need redundancy, do I need to import license to secondary node as well?

Re: Importing/Uploading ISE License

Arne Bier — Sun, 16 Jul 2017 10:03:40 GMT

Oh cool - I must have misinterpreted what the docs meant when they said "license can only be installed when STANDALONE or Primary" - therefore I concluded that a Secondary node wasn't going to receive the license. But thanks for clearing that up. Apologies for the confusion.

Re: Importing/Uploading ISE License

hslai — Sun, 16 Jul 2017 16:44:42 GMT

It works the same for ISE 1.3.

For redundancy, just ensure the licenses are issued with the UIDs from both the primary and secondary PAN, but you would only need it in case that the original secondary made the primary and in case that the licenses needed to be re-imported, for example, when you rebuild the whole deployment. There is also an option to rehost, as shown in the ISE License FAQ section of the ISE ordering guide.

Re: Importing/Uploading ISE License

dot1x — Mon, 17 Jul 2017 01:00:37 GMT

I'm currently going through Cisco ISE Admin Guide Release 1.3 and it's confusing:

It says:

If you have two Administration nodes deployed in a high-availability pair, you must ensure that each of them have the same license capabilities. Generate licenses with both UDIs and then add the licenses while each node is in a standalone or primary state.

Also:

You register all licenses to the Cisco ISE primary Administration node via the primary and secondary Administration node hardware UID. The primary Administration node then centrally manages all the licenses that are registered for your deployment.

Re: Importing/Uploading ISE License

hslai — Mon, 17 Jul 2017 01:06:05 GMT

That appears due to CSCuj50471. I will check it with our teams.