topic Re: Cisco ISE VM license question in Network Access Control

Cisco ISE VM license question

mpbaker82 — Mon, 11 Mar 2019 08:55:42 GMT

I found the license guide but I’m still unclear on the VM license.

Right now I have the following

base license

admin key which enables tacacs

and a VM (med) key for each of my nodes. All nodes are going to be deployed Vm server. 1 pan, 1 san, 5 psn nodes.

Do I need the base license? The guide makes me think I don’t need it.

Thanks

Re: Cisco ISE VM license question

hslai — Thu, 14 Feb 2019 02:31:15 GMT

For RADIUS auth, we need base licenses for concurrent endpoint sessions. For T+ auth, we need import a base license with minimally 100 endpoint sessions before T+ (device admin) license(s).

Re: Cisco ISE VM license question

Mike.Cifelli — Thu, 14 Feb 2019 02:34:53 GMT

Base licenses allow you to use 8021x, AAA features, trustsec, and macsec. If you are planning to use additional features that you would get from obtaining an apex license etc. you still must have base licenses. So yes you will need them.

Re: Cisco ISE VM license question

mpbaker82 — Thu, 14 Feb 2019 03:29:31 GMT

So if I understand correctly the VM license is just to install on a VM server. I would need one VM license per ise node.

I was was thinking the VM license served at the base license. Thank you for cleaning that up.

Re: Cisco ISE VM license question

Damien Miller — Thu, 14 Feb 2019 03:37:54 GMT

VM licenses (small medium, and large) are as already mentioned, one per node you deploy. 7 nodes in your case = 7 VM licenses.

The base licenses are per active endpoint. This is a bit of a misnomer because an endpoint is actually a mac address in ISE. If a single PC connects via wired and wireless, this can use two base licenses for a single "endpoint". Plus and Apex licenses for the deployment are also required if you use any profile or advanced endpoint authentication features.

There is a third license category, Device Admin node licenses. You also need one of these per VM you enable the device admin feature on, this is TACACS authentication for switches, routers, wlc etc. If you wanted to authenticate your administrators logins to network devices, and you only turn device admin on on two PSN's, then you only need two node licenses.