topic Re: ise licensing renewal in Network Access Control

ise licensing renewal

bluesea2010 — Mon, 06 Apr 2020 06:29:16 GMT

Hi,

My cisco ise license is expiring and try to renew but the license won't get on time due to the situation . Is it possible to add a trial license

Thanks

Re: ise licensing renewal

Marvin Rhoads — Mon, 06 Apr 2020 06:41:17 GMT

Your expired license will continue to work for end users. Management of the features for expired licenses will be curtailed.

See the following, quoted from the ordering guide:

Relevant ISE releases: 2.2 and later
Out of compliance: A license is out of compliance when
(a) the deployment uses more than 125% (to account for a temporary burst of usage) sessions compared to the quantity purchased; or
(b) the licenses have expired without renewal.
Compliance enforcement: The impact described below is experienced after a deployment is out of compliance for 45 out of 60 consecutive days.
Alerts will be provided every day that a license is out of compliance. For term licenses, alerts are provided, 90, 60 and 30 days before expiry and also for the last 30 consecutive days before expiry.
Impact: There will be no impact to end users. Existing configuration continues to operate without disruption. However, visibility and management of the features associated with an out-of-compliance license will be affected.

Re: ise licensing renewal

JayaDev01 — Mon, 06 Apr 2020 06:43:46 GMT

Hi @bluesea2010

I believe delivery of virtual products including licenses shall not be a problem in this "Very Very Sad Situation".

May I suggest reaching the Partner > AM > Disti shall help us.

We have got quite a few renewals done for our clients.

I have a slight doubt if the "Trial License" can be some rescue here.

Re: ise licensing renewal

bluesea2010 — Mon, 06 Apr 2020 18:40:31 GMT

Hi,

reply from partners are taking longer than expected and co-ordination issues

Thanks

Re: ise licensing renewal

bluesea2010 — Tue, 07 Apr 2020 07:37:57 GMT

Hi @Marvin Rhoads

under license usage ,current usage use shows like below

base : licensed 500 consumed 15000

apex :icensed 500 consumed 0

plus licensed 500 consumed 0

In that case ,how do I calculate the qty required for the base license ?

and Why apex and plus shows consumed 0

second thing , I have now base ,apex and plus , each qty 500 .When I renew do I need to renew the same amount for each

Or I can remove the apex and plus

Thanks

Re: ise licensing renewal

Marvin Rhoads — Tue, 07 Apr 2020 10:00:45 GMT

It sounds like your deployment is improperly licensed in comparison to what you are using.

If none of your policies use features in the Plus or Apex tiers then you can safely remove the expired/expiring licenses and be just fine.

Base licenses never expire but if you are using 15000 vs. 500 purchased then you are very much out of compliance.

Re: ise licensing renewal

bluesea2010 — Wed, 08 Apr 2020 11:05:01 GMT

hi @Marvin Rhoads

As far as I know Anyconnect requires apex license , but I am confused why apex does not show any

usage

I am planning to assign ip address based on the users group for wireless users . so I need plus license

One more question , when I renew license still do I need to get support license additionally

Thanks

Re: ise licensing renewal

thomas — Wed, 08 Apr 2020 21:28:02 GMT

See How to Get ISE Evaluation Software & Licenses > Additional Evaluation Licenses

Re: ise licensing renewal

Marvin Rhoads — Thu, 09 Apr 2020 04:45:00 GMT

First, AnyConnect licensing is never reflected in your ISE deployment. You only need AnyConnect Apex licenses if you are using ISE for Posture/Compliance use case and not using agentless posture. If you have no posture policies then you don't need AnyConnect Apex.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc18

If you are using AnyConnect Network Access Manager (NAM) module as your 802.1x supplicant (which can be done with ISE Base licenses) it only requires AnyConnect Plus licenses (still, AnyConnect licenses - no matter what type - are managed completely separate from your ISE deployment).

Re: ise licensing renewal

bluesea2010 — Thu, 16 Apr 2020 07:11:52 GMT

Hi @Marvin Rhoads

You are really helpful .

Thanks for the reply . it would be great help if you tell me the difference between the below

1 ) L-ISE-BSE-PLIC and L-ISE-BSE-P3

2 ) L-ISE-PLS-LIC and L-ISE-PLS-1Y-S3

you said "First, AnyConnect licensing is never reflected in your ISE deployment " .

what you mean by

Anyconnect license is on ASA , right ?

Do we need anyconnect apex on license on ASA and ise apex license at the same time for posture/ compliance

Thanks

Re: ise licensing renewal

Marvin Rhoads — Fri, 17 Apr 2020 06:06:27 GMT

L-ISE-BSE-PLIC is the top level SKU for ISE Base licenses. Depending on how many are in a given order the price varies and a different sub-SKU applies. L-ISE-BSE-P3 is for orders with 500-999 licenses.

L-ISE-PLS-LIC and the associated sub-SKU is similar with the added distinction that Plus (and Apex) licenses are term-based so they also specify the term (1, 3 or 5 years).

AnyConnect Apex licensing on the ASA is necessary if you are doing posture compliance checking for your remote access VPN clients. On the ASA it appears as "AnyConnect Premium" (the old nomenclature) and, no matter how many are in the purchase, activating an AnyConnect PAK on the ASA will always show the maximum number supported by the hardware - not the purchased number. This is because you are licensed per unique users, not by number of potential sessions.

You could also be doing posture compliance checking on wired or wireless clients (non-VPN) and they would also require AnyConnect Apex licenses. In this latter case, no appliance actually monitors usage of those licenses - it is up to the admin to know what is being installed and remain compliant with the terms of the licensing agreement (i.e., with respect to number used).

Re: ise licensing renewal

bluesea2010 — Sun, 19 Apr 2020 05:47:44 GMT

Hi @Marvin Rhoads

Thanks a lot of your support . My maintenance support team advised to delete the existing subscription license(not trial) for base ,apex plus- 500 qty reach

and add a trial license or base ,apex plus- 100 qty till we get the subscription license . His point is that if base license expired nothing will work , your vpn authentication may stop , wireless authentication fails . Based on your previous reply I tried to convince him authentication process will continue .

what is the impact of deleting the existing license (base ,plus ,apex) ,add evaluation license and later import 500 subscription license .

Any benefit or negative impact .

My current license renewal is under process , I will receive only after subscription license expires .

Thanks a million

Re: ise licensing renewal

Marvin Rhoads — Sun, 19 Apr 2020 07:47:54 GMT

@bluesea2010 ISE Base licenses generally don't expire (exception being the old mobility licenses but we seldom see those anymore since they haven't been sold for the past four years and had a maximum five year term). So there's no reason to delete your permanent Base licenses.

I don't mean to disparage anyone, but it sounds like your maintenance support team might not be very familiar with ISE licensing. Still, if you want to follow their advise vs. that of someone who's been working with ISE for about 8 years, that's your call.

Re: ise licensing renewal

bluesea2010 — Sun, 19 Apr 2020 09:25:55 GMT

Hi @Marvin Rhoads

The license is bought 5 years back for five year term . So it may be mobility license ?

attached the screenshot , is it mobility license .

" but it sounds like your maintenance support team might not be very familiar with ISE licensing."

That's true . Thats the reason I am following your advise .

Now I got confused . How to verify that I am using mobility license .

Thanks

Re: ise licensing renewal

Marvin Rhoads — Sun, 19 Apr 2020 10:11:11 GMT

Yes - you have the old Mobility license. It is no longer sold or eligible for renewal.

So you would indeed have to delete the existing license to install a 90-day Evaluation license. However make sure you can get one first - that is, actually get it and confirm it.

Cisco would technically have the right to not issue an evaluation license to a deployment that already has a purchased term license.

Best approach is to buy the proper license that you require. Those are typically issued within 24-48 hours after the sales order is placed in the Cisco system.

Re: ise licensing renewal

bluesea2010 — Sun, 19 Apr 2020 10:43:57 GMT

Hi @Marvin Rhoads

So in that case , if I don't renew I will loose all the connectivity . I have only two days .

currently my apex and plus usage is 0 , so If I renew only base license remote users (VPN) can authenticate ?

Thanks

Re: ise licensing renewal

Marvin Rhoads — Sun, 19 Apr 2020 14:19:25 GMT

Your end users will not be impacted when the license expires.

As noted in my reply from 6 April:

Alerts will be provided every day that a license is out of compliance. For term licenses, alerts are provided, 90, 60 and 30 days before expiry and also for the last 30 consecutive days before expiry.
Impact: There will be no impact to end users. Existing configuration continues to operate without disruption. However, visibility and management of the features associated with an out-of-compliance license will be affected.

Re: ise licensing renewal

bluesea2010 — Sun, 19 Apr 2020 16:09:46 GMT

Hi @Marvin Rhoads

"Your end users will not be impacted when the license expires."

I got your point .

I thought this is only for the new license and not for the old mobility license scheme

Thanks

Re: ise licensing renewal

Sp@wn — Mon, 12 Jun 2023 12:31:50 GMT

Hello Marvin,

Our customer's mail server has been changed, but since no new smtp server configuration has been made on the ISE, it could not send warning mails. The ISE version is 2.7 and the license grace period is almost over. If we still haven't obtained a license during grace period, after the grace period will ISE continue to recognize android and apple devices and allow access to the network even if the configuration menus are closed, by following the rules written for them?

Kind Regards,

Re: ise licensing renewal

Marvin Rhoads — Mon, 12 Jun 2023 14:02:59 GMT

Sp@wn , yes ISE will continue indefinitely to enforce existing access policies even after the current licenses expire. The admin GUI on the PAN will remove all options except the ability to update the licensing information.