topic Re: Second PAN licensing, Evaluation until failover in Network Access Control

Second PAN licensing, Evaluation until failover

mtotelenivel1 — Tue, 11 Jul 2023 14:32:33 GMT

Hello comunity!

We have an ISE v.3.2p1 and licensing with CSSM. With one PAN licensed it's seen at Licenses In Compliance, it seems it's correct.

When a second PAN is installed it is mandatory to get a new license. No error are seen and new license has been applied correctly. But at this time at licenses it's seen Evaluation instead In Compliance. We wait for 5hours and equal.

At the time a failover is done, the second PAN becomes primary with license In Compliance and if we do a second failover the first PAN becomes again primary and also licenses are shown as In Compliance.

It seems to appear only the first time you license the PAN.

Please, any ideas about this behavior?

Thank you in advance.

Best regards!

Re: Second PAN licensing, Evaluation until failover

Arne Bier — Mon, 24 Jul 2023 20:25:45 GMT

Hi @mtotelenivel1

Not sure what you meant by "No error are seen and new license has been applied correctly. But at this time at licenses it's seen Evaluation instead In Compliance. We wait for 5hours and equal. "

I always configure Smart Licensing once I have the Secondary PAN registered to the Primary. I think this is the way it should be, since you will see one entry in CSSM (the UUID of the Primary) and it also lists the Secondary UUID as the HA.

If you simply register a Secondary PAN to an ISE deployment where the Primary is registered to CSSM, then I don't think the Secondary will automatically be added to Smart. But I might be wrong. Perhaps it should be like that, but I leave licensing as my last step.

Re: Second PAN licensing, Evaluation until failover

hslai — Sun, 30 Jul 2023 03:28:57 GMT

CSCwf17490

might be what you are seeing.