topic Re: License count and active session do not match in Network Access Control

License count and active session do not match

dgaikwad — Fri, 19 Aug 2022 13:07:37 GMT

Setup:
Version 2.4 patch 5.

The active sessions are at a count of 47, but the base license consumption is peaked at 650 and plus at 100.
Any idea why such a dependency is visible?

Re: License count and active session do not match

ahollifield — Fri, 19 Aug 2022 14:54:44 GMT

This is a REALLY old patch of ISE 2.4. I would install the latest patch (14) before doing any additional troubleshooting. Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-743964.html

Re: License count and active session do not match

thomas — Sat, 20 Aug 2022 15:25:35 GMT

You currently have 47 active sessions. This probably changes quite dynamically throughout the day as users and their devices come and go.

You had a peak of 650 and 100.

I don't understand the problem.

Re: License count and active session do not match

dgaikwad — Mon, 22 Aug 2022 07:47:50 GMT

If the number of active sessions on the dashboard at 47, while the license consumption is showing 650...
And the amazing thing is that we do not even have that many combined all offices!

Re: License count and active session do not match

dgaikwad — Mon, 22 Aug 2022 07:48:25 GMT

Thank you! Getting it patched to the latest one is being planned for upcoming month.

Re: License count and active session do not match

hslai — Thu, 25 Aug 2022 02:16:10 GMT

The active endpoints count at ISE dashboard is based on the ISE context visibility while the licensing consumption is based on the ISE session directory. ISE session directory would keep the sessions as active when the accounting STOP requests do not carry the same class attribute.

Re: License count and active session do not match

dgaikwad — Thu, 25 Aug 2022 06:55:44 GMT

If that is the case then, is there any way that the license consumption is reflected by the number of actual active endpoints?
Or how to flush the session directory?

Re: License count and active session do not match

hslai — Mon, 29 Aug 2022 21:41:29 GMT

When a client endpoint gets no further updates after 5 days, ISE will purge it from the active session. Else, you may use ISE API > Using API calls for Session Management > Stale Sessions to manage the sessions.