topic Re: ISE Licensing Issue in Network Access Control

ISE Licensing Issue

lowfell — Wed, 17 Mar 2021 09:28:02 GMT

Hello all. I have a customer where they have 5000 Base licenses and the report is saying they are 400 over subscribed. The customer is Adamant that they don't have that many connections so wants to know where the licenses are being used?

They also have 5000 "Plus" licenses which show zero usage. Could it be that the base licenses are being used where Plus licenses should be and this would explain the shortfall?

Isn't the usage supposed to be automatic if they need plus licenses?

Re: ISE Licensing Issue

Karsten Iwen — Wed, 17 Mar 2021 10:02:35 GMT

Make sure that all network access devices have RADIUS accounting enabled. This problem could be caused by licenses not being released correctly.

Re: ISE Licensing Issue

Marcelo Morais — Wed, 17 Mar 2021 11:34:04 GMT

Hi @lowfell ,

beyond what @Karsten Iwen said ... remember that:

. Licenses are counted against Concurrent Active Sessions and a session starts with a RADIUS Accounting Start message !!!
. Licenses are released for ALL features when the Endpoint's Session ends !!!
. ISE will maintain a session as active for 5 days unless one of three things happens.
1. An Interim Accounting packet is sent by the SW/WLC telling ISE that the Endpoint is still connected and active.
2. A Reauthentication of the Endpoint happens, this results in a new accounting start, and the 5 day timer resets.
3. A RADIUS Accounting Stop message is received by ISE, the session is no longer active and the license will be released.

Hope this helps !!!

Re: ISE Licensing Issue

lowfell — Wed, 17 Mar 2021 13:17:33 GMT

Hello and thank you, so do you make licenses release correctly please?

Re: ISE Licensing Issue

thomas — Wed, 17 Mar 2021 14:15:56 GMT

ISE 2.x License Consumption:

ISE Service	ISE License	License Consumed	License Released
Authentication	Base	A Base license is consumed when an endpoint establishes an active network session (RADIUS)	RADIUS session ends
Authentication	Mobility	A Mobility license is consumed when a wireless or VPN endpoint establishes an active network session	RADIUS session ends
Authentication	Mobility Upgrade	A Mobility Upgrade license is consumed when a wired endpoint establishes an active network session	RADIUS session ends
Profiling	Plus	A Plus license is consumed when an endpoint with an active session uses profiling classification (Endpoints.EndPointPolicy or Endpoints.LogicalProfile) in an authorization policy	RADIUS session ends
BYOD	Plus	A Plus license is consumed when an endpoint with an active session uses its registration status (EndPoints.BYODRegistration) in an authorization policy	RADIUS session ends
MDM (Partner)	Apex	An Apex license is consumed when an endpoint uses an MDM attribute (MDM.*) in an authorization policy	RADIUS session ends
Threat-Centric NAC	Apex	An Apex license is consumed when an endpoint uses or triggers threat based information or action (Session:ANCPolicy) as part of the authorization policy	RADIUS session ends
Posture	Apex	An Apex license is consumed when an endpoint with an active session receives an authorization based on a posture status (Session.PostureStatus) other than “Not applicable” (for example, Compliant, Not compliant, Pending, or Unknown)	RADIUS session ends or the endpoint re-authenticates to a session that does not require posture

Re: ISE Licensing Issue

lowfell — Wed, 17 Mar 2021 14:36:31 GMT

Does anyone know how to release stale sessions please?

Re: ISE Licensing Issue

lowfell — Thu, 18 Mar 2021 07:29:19 GMT

Is there a report we can run that can give me a count of the sessions against licensing?

I'm sure this has occurred before and Cisco said it's just "Cosmetic" to be honest that's not very helpful, what is the point of licensing then if the machine reports out of compliance when actually you aren't?

Re: ISE Licensing Issue

Marcelo Morais — Thu, 18 Mar 2021 11:02:45 GMT

Hi @lowfell

at Operations > Reports > Reports > Endpoints and Users > Current Active Sessions ... check for the License Type and License Details column.

Hope this helps !!!

Re: ISE Licensing Issue

lowfell — Thu, 18 Mar 2021 12:09:48 GMT

We've opened an SR as we pulled a report and couldn't see where they were over, although we didn't look at the way you described. I wish I'd known before I opened the case, never mind. I'll let you know how we ge ton,

Thanks again for all your help.

Re: ISE Licensing Issue

Marcelo Morais — Thu, 18 Mar 2021 15:38:33 GMT

Hi @lowfell ,

you asked before: "Does anyone know how to release stale sessions please?"

Please take a look at: ISE API Reference Guide 2.7., search for Removing Stale Sessions.

Hope this helps !!!