topic ISE Plus license consumption in Network Access Control

ISE Plus license consumption

blandrum — Wed, 27 Apr 2016 18:16:02 GMT

How are plus licenses counted inside of ISE? In particular, how do I control what devices consume these licenses? If I own 20,000 base licenses, but only need profiling on 10,000 endpoints in a particular section of my network (particular buildings perhaps), how do I control that? I'm assuming a plus license is consumed for each profiled device that is currently online, but my DHCP / HTTP probes are centralized to the network infrastructure and see every device, even those that aren't being controlled by ISE.

There is no onboarding taking place, just dot1x with MSCHAPv2 across wired and wireless networks.

Thank you

Re: ISE Plus license consumption

Timothy Abbott — Wed, 27 Apr 2016 18:43:25 GMT

Brad,

They are consumed in the same manner as a base license with a slight difference. If you use profiling policy in authorization, then every device that matches that policy will consume a plus license. Here's an example: I have access points in my network that I want to authenticate with ISE and I write an authorization rule that looks like the following:

Cisco APs: If Cisco-Access-Points AND Wired_MAB then AP_Access

Every Access point that has been profiled as a Cisco-Access-Point and matches the above rule will consume a license for the duration of the authentication session. Hope that helps.

Regards,

-Tim

Re: ISE Plus license consumption

blandrum — Wed, 27 Apr 2016 19:01:01 GMT

Awesome, that’s what I was thinking but appreciate the quick response and verification.

Thank you,

Brad Landrum

Systems Engineer | Cisco Systems