topic Re: ISE license usage issue. in Network Access Control

ISE license usage issue.

morabusa — Wed, 01 Dec 2021 22:21:09 GMT

Hi, we are having issues with a customer ISE cosuming 57500 licenses, while they just have 1000 base licenses. After checking the devices, I have figured out that the issue was related to accounting did not work properly, and I have fixed. Now the problem is that I am still seeing 57500 licenses, and I have the same output when checking the sessions alive in the ISE:

sessionCount

count 53726 count

There are not more than 300 concurrent users connected daily, so I do not know how to kill these 50K sessions in order to solve the license usage issue. I have set the purge parameters to purge greater than a day endpoints, but not sure if it will helps. Is there a way to remove these sessions manually? Thanks.

Re: ISE license usage issue.

Arne Bier — Thu, 09 Dec 2021 04:58:13 GMT

I believe that ISE will release any "unmanaged" sessions after 4 or 5 days. This means the number should reduce to sane levels after you have enabled RADIUS accounting to maintain the session "monitoring". But if after 5 days the session count is still high, then perhaps it's time to stop the ISE applications on the MNT nodes. I would suspect they are involved in reporting those figures.

There are other things that TAC might suggest (e.g. configure application ise, and then choosing one of the options to reset the session database). I would try the application stop/start first.

Re: ISE license usage issue.

morabusa — Fri, 10 Dec 2021 07:32:35 GMT

HiI did try to stop/start ISE application but without success, for some reason 57K sessions were still alive after restarting. I finally managed to fix the issue after killing all the active sessions using the ISE API:

curl -u username:password -X DELETE https://<ISE IP address>/admin/API/mnt/Session/Delete/All --insecure

Thanks for the help.