topic Re: ISE Licensing 3.X for TACACS only in Network Access Control

ISE Licensing 3.X for TACACS only

MIKE GLASS — Thu, 01 Feb 2024 14:03:49 GMT

Hello,

I want to replace my Cisco ACS 5.8 infrastructure with Cisco ISE 3.X to maintain only my TACACS+ service.
I have about 2000 network devices, switches, routers, WLC's, AP's using TACACS for authentication and I currently use one large deployment license for Cisco ACS 5.8.
For Cisco ISE 3.X. What licenses and how many licenses will I need running 2 Virtual Machines with 2 PSN's?

1 or 2 L-ISE-TACACS-ND=

2 X R-ISE-VMC-K9=

Does this require any Cisco Identity Service Engine Essentials Subscription licenses?

Thanks in advance for any help you can offer here.

Re: ISE Licensing 3.X for TACACS only

Aref Alsouqi — Thu, 01 Feb 2024 15:36:43 GMT

You wouldn't need any essential or higher licenses as you will only be using TACACS services on those nodes. So you need 2x TACACS licenses "L-ISE-TACACS-ND=" as well as a VM license "R-ISE-VMC-K9=" for each PSN as you mentioned.

Also, please note that you can use the ACS > ISE migration tool from Work Center > Device Administration > Overview. You should see a link in the "Prepare" section to download the tool from Cisco website. If you should use that tool, it is highly recommended to review all the migrated configs.

Re: ISE Licensing 3.X for TACACS only

ahollifield — Thu, 01 Feb 2024 16:58:46 GMT

Note that the latest ISE version the ACS to ISE migration utility is ISE 3.0. So you would need to migrate from ACS to ISE 3.0 and then upgrade ISE to 3.2 or 3.3. Or rebuild manually.