topic Cisco ISE Device Admin Licensing in Network Access Control

Cisco ISE Device Admin Licensing

Maurice Ball — Sun, 24 May 2020 19:15:08 GMT

Do I need a Cisco ISE device admin license for every PSN I enable the service on?

For example: If I enabled the device admin service on 5 of my policy nodes. Does this mean I would need 5 device admin licenses installed on the primary admin node?

Re: Cisco ISE Device Admin Licensing

Damien Miller — Sun, 24 May 2020 19:46:40 GMT

Yes, as of ISE v2.4+ you need one L-ISE-TACACS-ND= license per PSN you enable the device admin role on. So enabling device admin on five PSNs would require ordering 5x L-ISE-TACACS-ND=. You then have the option of either putting them in to a smart account ISE can be pointed at, or fulfilling them as a traditional license file and installing it on the admin node.

Re: Cisco ISE Device Admin Licensing

Maurice Ball — Sun, 24 May 2020 19:51:29 GMT

Ok, great. I just wanted to make sure I understood it correctly. Thanks so much for the clarification.

Re: Cisco ISE Device Admin Licensing

Mohammed al Baqari — Mon, 25 May 2020 07:56:58 GMT

Hi,

Your device admin license are counted by the number of devices not by the
number of PSN nodes. You PSN nodes consume VM license only. But feature
license can be shared between them.

**** please remember to rate useful posts

Re: Cisco ISE Device Admin Licensing

Damien Miller — Mon, 25 May 2020 08:05:24 GMT

Not with ISE.

That was the case with ACS, 500 vs large deployments. ISE 2.4+ licenses both virtual ISE nodes, and tacacs/device admin nodes by the number deployed.

Re: Cisco ISE Device Admin Licensing

Mohammed al Baqari — Mon, 25 May 2020 09:36:51 GMT

Thanks for correcting me Damien.