topic Re: ISE Licensing alert ... ? in Network Access Control

ISE Licensing alert ... ?

Frank Lothar Weber — Mon, 11 Mar 2019 08:49:43 GMT

Hi, all.

Can anybody make sense of this:

A few days ago, our ISE deployment threw a licensing alert during gui login:

This alert told me, that the installed apex licenses (3500) have been exceeded by >125% .... !!

Funny, because ISE licensing guide tells me, that apex licenses are used only when you do posture/compliance checks, or when you have an MDM connected to ISE ....

Well, we don't do posture (it is planned to use it) and we do not have a MDM ... !!!

What the hell is that alert trying to say to me ??

What we do use on ISE is device profiling, it is heavily used in the authorization rules.

But this should not eat up apex licenses, it should make use of the "plus" licenses only (we got 25000).

Here is a complete listing of our licenses and services:

Base: 25000

Plus: 25000

Apex: 3500

Services: Profiling, NO posture, NO mdm

I am a little worried, what this alert means exactly:

Is this just a cosmetic bug (ise alert engine counting licenses wrong), or will the box stop to work when the shown timeframe exceeds ???

Rgs

Frank

Re: ISE Licensing alert ... ?

Jason Kunst — Wed, 19 Sep 2018 13:02:45 GMT

See the licensing guide for more information

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

Regardless please investigate with tac on possible reason why and log bug or attach to existing one if exists

Re: ISE Licensing alert ... ?

Arne Bier — Wed, 19 Sep 2018 22:40:53 GMT

Hi @Frank Lothar Weber

Please let us know if the TAC find anything. It might be useful to others on this forum who may run into this issue (prevention is better than cure 🙂

What version/patch are you on

Traditional or Smart Licensing?

cheers

Re: ISE Licensing alert ... ?

Frank Lothar Weber — Thu, 20 Sep 2018 10:01:13 GMT

Hey,

We are using v2.2 (latest patch) with traditional licensing .....

I already have a case opened for this, but TAC seems pretty helpless with this,

only thing I got back from them is:

Please install ISE 2.4 patch 3 !!!!

Well, I gladly would, if we were running ISE 2.4, not 2.2 .... !!!

Re: ISE Licensing alert ... ?

Jason Kunst — Thu, 20 Sep 2018 11:08:45 GMT

If this is indeed service impacting at some point You would need to escalate with them and tell them not acceptable and ask why? Right now seems cosmetic however and not warrant an upgrade to 2.4 which will eventually (perhaps with patch 4) be our new gold long term release. Make sure they have a defect assigned and let us know

Re: ISE Licensing alert ... ?

Frank Lothar Weber — Thu, 20 Sep 2018 11:19:19 GMT

Will do ....