topic Re: ISE 2.1 Plus license consumption in Network Access Control

ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Fri, 21 Feb 2020 18:47:27 GMT

Hi all,

I am trying to figure out why our ISE server is reporting the consumption of plus licenses. As far as I understand 802.1x only consumes Base licenses. We are not doing profiling and we are not using any feature that requires Plus licenses.

Am I doing something wrong?

Here are some screen captures

Thanks

Re: ISE 2.1 Plus license consumption

paul46 — Mon, 05 Mar 2018 23:51:24 GMT

Plus

Subscription (1, 3, or 5 years)

Bring Your Own Device (BYOD)
Profiling
Endpoint Protection Service (EPS)
TrustSec SGT

Does not include Base services. A Base license is required for each Plus license.

Re: ISE 2.1 Plus license consumption

Francesco Molino — Mon, 05 Mar 2018 23:53:27 GMT

Plus licenses are also consumed if you use some default group like registered devices or if you create cold group of those parent groups.

Can you share please your policy-set and devices groups to see if something there can consume any plus license?

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Mon, 05 Mar 2018 23:59:30 GMT

Here I am attaching our Endpoint identity groups.

Is that what could be causing the plus license consumption?

Re: ISE 2.1 Plus license consumption

Francesco Molino — Tue, 06 Mar 2018 00:04:38 GMT

You're using RegisteredDevices and this one consume plus license.
Create a new parent group, move your subgroups to this new one, clear all active sessions and everything should be fine after.

Let me know.

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Tue, 06 Mar 2018 00:09:07 GMT

Thanks for the quick replies. Is it possible to move the existing identity groups from one parent group to another?

I don't see that option

Re: ISE 2.1 Plus license consumption

Francesco Molino — Tue, 06 Mar 2018 00:14:13 GMT

No you can't. When i say move it means the normal process, export your macs, create group and import your macs.

Sorry i shouldn't use the word move 🙂

Re: ISE 2.1 Plus license consumption

Francesco Molino — Tue, 06 Mar 2018 00:33:50 GMT

I forgot to tell you, if you have coa enabled globally when you're going to move mac addresses to a new group, a coa will reauth them

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Tue, 06 Mar 2018 00:34:55 GMT

No CoA.

Thanks for your help on this. I will try it out soon and let you know the result.

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Wed, 07 Mar 2018 14:45:47 GMT

Francesco, quick question.

If the identity group I created is under the parent group called Profiled will it also use Plus licenses?

Check the attachment

Re: ISE 2.1 Plus license consumption

Francesco Molino — Wed, 07 Mar 2018 15:17:40 GMT

Hi Paul

Yes it's gonna use Plus license

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Wed, 07 Mar 2018 15:23:57 GMT

Thanks again for the reply. I created a new parent group and inside that new group I created the desired endpoint group but when I try to import the list of endpoints I tells me that the identity group is not valid.

Attaching the screenshot of the new parent group and the error

Not sure what is going on.

Re: ISE 2.1 Plus license consumption

Francesco Molino — Wed, 07 Mar 2018 15:31:54 GMT

Can you share the printescreen of newly created groups and the csc you're trying to import?

I'll take a look at it later

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Wed, 07 Mar 2018 16:01:25 GMT

Attached the screenshots of the newly created groups

Basically the parent group is XXX-WHITELISTS and the sub-group is WL-XXX-OFFICE

If I use the same csv but using another group that belongs to the parent group Profiled the upload works fine and it gets assigned the right group.

Re: ISE 2.1 Plus license consumption

Francesco Molino — Wed, 07 Mar 2018 17:20:52 GMT

Here a Template.csv I use and tested it again with subgroups and it works.

Re: ISE 2.1 Plus license consumption

PAUL GILBERT ARIAS — Wed, 07 Mar 2018 22:49:11 GMT

Same issue. Can you share a screenshot of the group and subgroup?

Re: ISE 2.1 Plus license consumption

Francesco Molino — Wed, 07 Mar 2018 22:55:08 GMT