topic ISE licensing in Network Access Control

ISE licensing

JACQUES DU PLESSIS — Mon, 11 Mar 2019 06:07:46 GMT

Hi Guys, I am confused regarding ISE licensing. We want most of the items, including wired, wireless, VPN, Guests, profiling, posture etc.

So a vendor quoted on base + endpoint apex licenses (and anyconnect) and they say that will cover us.

Is this correct since the licensing page suggests we need much more than that?

Thanks!

Jacques

While you can technically run

Marvin Rhoads — Tue, 06 Oct 2015 14:09:18 GMT

While you can technically run an ISE deployment with only Base and Apex (and AnyConnect Apex if you aren't using native supplicants) licenses, you typically require Plus licenses also if you are planning to use any of the services it provides (including profiling).

You also need the line items for the server(s) themselves - whether appliance- or VM-based.

Yes they came back to me

JACQUES DU PLESSIS — Tue, 06 Oct 2015 16:38:07 GMT

Yes they came back to me saying we need plus as well. Management would not have been very impressed having to go back to business asking for more money. And yes we are doing the VM

Thanks for the reply

Jacques

Hi,ISE posturing feature not

Shaik Moinuddin — Sun, 11 Oct 2015 05:49:46 GMT

Hi,

ISE posturing feature not supported in VM-based.

regards,

Shaik,What is your source for

Marvin Rhoads — Sun, 11 Oct 2015 14:14:46 GMT

Shaik,

What is your source for that information? I have configured VM-based ISE deployments with posturing enabled and actively in use.

The Posture feature requires Apex licensing (or the old Advanced license for pre-1.3 deployments) but is not limited to physical vs. virtual machine-based nodes.

hi Marvin,i found it on Cisco

Shaik Moinuddin — Mon, 12 Oct 2015 05:30:55 GMT

hi Marvin,

i found it on Cisco..

ISE Features Not Supported in a Virtual Machine

The Inline Posture node is supported only on Cisco SNS-3415 and Cisco ISE 3300 series appliances. It is not supported on Cisco SNS-3495 series or VMware server systems. All the other designated roles are supported for use on VMware virtual machines.

Shaik,Inline Posture Node or

Marvin Rhoads — Mon, 12 Oct 2015 12:44:09 GMT

Shaik,

Inline Posture Node or IPN is not the same as the posture feature.

IPN is used when we need to support posture services and the network access device (typically a legacy firewall) does not support CoA. Under the covers it is a legacy NAC appliance rebranded as an ISE node.

It was rarely deployed. Since ASA software 9.2(1) introduced CoA support, it is becoming even less common.

Posture is part of session services and is supported on VMs across all ISE versions as long as you have the necessary license.