topic Re: Cisco ISE registration Failed !! in Network Access Control

Cisco ISE registration Failed !!

Ditter — Sat, 01 Apr 2023 18:59:42 GMT

Hi to all,

i started getting the messages you see at the bottom of the thread in my ISE 2.7.0.356 with patches 1,2,4 installed.

I downloaded a new token in order to register the system, but nothing changed. I also deregistered and registered the system , nothing changed also.

The funny thing is that it mentions "Evaluation period of Smart Licensing has expired." probably due to deregistration/registration i did.

I recall in the past there were some changes in cisco server and there was a certificate issue, maybe the same situation holds true about ISE?

The system worked just fine 5 years now in conjunction with smart software central.

Any help appreciated.

Thanks

Ditter.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Alarm Name :
Smart Licensing Evaluation Period Expired

Details :
Smart Licensing evaluation period expired: Details=Smart Licensing evaluation period expired

Description :
Evaluation period of Smart Licensing has expired.

Severity :
Critical

Suggested Actions :
Refer to the ISE License Administration page to register ISE with Cisco Smart Software Manager.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

CISCO ISE suddenly has problem with smart licencing!

Ditter — Sat, 01 Apr 2023 18:58:27 GMT

Hi to all,

i started getting the messages you see at the bottom of the thread in my ISE 2.7.0.356 with patches 1,2,4 installed.

I downloaded a new token in order to register the system, but nothing changed. I also deregistered and registered the system , nothing changed also.

The funny thing is that it mentions "Evaluation period of Smart Licensing has expired." probably due to deregistration/registration i did.

I recall in the past there were some changes in cisco server and there was a certificate issue, maybe the same situation holds true about ISE?

The system worked just fine 5 years now in conjunction with smart software central.

Any help appreciated.

Thanks

Ditter.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Alarm Name :
Smart Licensing Evaluation Period Expired

Details :
Smart Licensing evaluation period expired: Details=Smart Licensing evaluation period expired

Description :
Evaluation period of Smart Licensing has expired.

Severity :
Critical

Suggested Actions :
Refer to the ISE License Administration page to register ISE with Cisco Smart Software Manager.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

Re: CISCO ISE suddenly has problem with smart licencing!

balaji.bandi — Sat, 01 Apr 2023 19:10:17 GMT

check here most of the FN:

https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-field-notices-list.html

check the communication to the cisco License Server and verify the settings again :

suggested steps :

in Administration > System > Licensing try to:

1. update the Smart Licensing Registration ... clicking the Update button

2. deregister and register the Smart Licensing (you will need the Registration Token for that)

Note: pay attention to your Smart Licensing Registration - Connection Method (Direct HTTPS, HTTPS Proxy or Transport Gateway).

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/m_ise_man_license.html

The bug should have fixed by now :

CSCwa13877 : Bug Search Tool (cisco.com)

Re: Cisco ISE registration Failed !!

Ditter — Sun, 02 Apr 2023 17:01:40 GMT

Thanks for the help. I did the deregister/reregister procedures again. What is strange is that for example it mentions TACACS+ evaluation expired and when i do a disable/enable this specific tacacs+ license then it shows correctly , IN COMPLIANCE.

One moment it is in state evaluation expired and the next moment after a disable/enable it gets its normal state which is in compliance

Is there by any chance a problem with certificates? Or maybe i should have a speicific certificate in the ISE repository?

Thanks,

Ditter.

Re: Cisco ISE registration Failed !!

ahollifield — Mon, 03 Apr 2023 13:08:23 GMT

I would personally install the latest 2.7 patch before spending anymore time troubleshooting this issue.

Re: Cisco ISE registration Failed !!

Ditter — Mon, 03 Apr 2023 18:27:19 GMT

Patched the cluster to latest 9 patch and registration is now success. I believe that part of the latest update contains updated info about trusted certs and now ISE registers OK.

The only problem that remains is that although i have several thousands base licenses in my smart account they do not show in the ISE licensing page , nevertheless the tacacs+ licenses show correctly.

The base license is Enabled but with Released Entitlement and 0 count.

Any ideas about that?

Thanks,

Ditter.

Re: Cisco ISE registration Failed !!

ahollifield — Mon, 03 Apr 2023 18:41:54 GMT

Do you have RADIUS Accounting enabled on your NADs? It can also take time for the licensing dashboard to properly populate.

Re: Cisco ISE registration Failed !!

Ditter — Tue, 04 Apr 2023 12:18:15 GMT

Thanks for the answer,

yes i have radius accounting active and after one day , i have radius clients and dot1.x clients coming in and out the network, the base licence count increases and decreases accordingly but at the cisco software central the licenses stay steady at the initial amount that was purchased , i mean that the license count should decrease according to the clients that have used the resources of the ISE for authentication/authorization via the radius services.

Probably the reason is that i use the ISE as a proxy radius?? I do not really know.

Anyway,

Thanks

Ditter.

Re: Cisco ISE registration Failed !!

ahollifield — Tue, 04 Apr 2023 13:00:12 GMT

So ISE isn't terminating any RADIUS sessions? It's proxy to an external RADIUS server?

Re: Cisco ISE registration Failed !!

Ditter — Tue, 04 Apr 2023 13:08:59 GMT

For most of applications yes, it acts as a proxy radius.

But regardless of that shouldn't i have under Administration--> Licensing the total number of base licenses i have purchased?

It still shows under Compliance "Released Entitlements."

Shouldn't this be "in compliance"?

As i mentioned the smart account is populated correctly with the total amount of licenses.

Re: Cisco ISE registration Failed !!

ahollifield — Wed, 05 Apr 2023 21:14:50 GMT

So your Essentials licenses show “released” you need to activate the license on ISE on the licensing page. Also though, I don’t think RADIUS proxy actual consumes any licenses though