topic ISE Plus License usage in Network Access Control

ISE Plus License usage

GRANT3779 — Fri, 21 Feb 2020 18:34:23 GMT

When exactly does a Plus License get used?

I have profiled Cisco Phones that Authenticate via MAB and then pass the following authorisation policy -

"If Device is in Endpoint Identity Group / Profiled / Cisco IP Phones then allow access to voice domain"

The phone authorises fine but I do not see a Plus license being used.

I would have thought because the auth policy is checking a group which contains profiled devices a plus license would be used upon access to the network.

Re: ISE Plus License usage

Arne Bier — Thu, 21 Sep 2017 00:21:25 GMT

Good question - the exact mechanics of how licenses are consumed is not well explained by Cisco. The closest answer I have read is exacly what you mentioned. However - your AuthZ policy is not referring to a profiling attribute. You are simply checking whether a device is in an Endpoint Group. That comes for "free" with the base license, because Endpoint Identity Groups are used for multiple purposes.

I don't have a concrete example, because I don't have PLUS (or EVAL) licenses, but if you were to start doing fancy AuthZ policies that involve conditions about the stuff you found as a result of profiling, then I would assume you'd consume a PLUS license.

Re: ISE Plus License usage

GRANT3779 — Tue, 26 Sep 2017 19:39:45 GMT

Hi Arne,

Yes I guess that makes sense. I may test a few different auth profiles to see if I can find some consistency as to when a plus license is used.

Thanks