topic Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715 in Network Access Control

Re-hosting CIsco ISE SNS-3515 -> SNS-3715

iVicMMac — Thu, 29 Feb 2024 00:53:24 GMT

Hello,

I have doubt about re-hosting the licenses(essentials) on Cisco SNS-3515 to a SNS-3715, is this possible? if so, are there any restrictions or something that avoid the re-hosting between these two devices?

Thanks in advance

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

Arne Bier — Thu, 29 Feb 2024 02:22:32 GMT

Hi @iVicMMac

Your SNS-3515 is running ISE 2.7?

Remember that SNS-3715 will only run a version of ISE that mandates Smart Licensing. So therefore, there will be no license re-hosting possible

Any ISE 2.7 licenses you have today (e.g. TACACS or Base/Plus/Apex) will need an equivalent in the Smart License Virtual Account

You can convert your TACACS license from Traditional to Smart - you should then have 50 TACACS licenses in Smart, that your new SNS server can use

You cannot convert Base/Plus/Apex to the new Essentials/Advantage/Premier - that will require a purchase of those subscriptional licenses.

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

iVicMMac — Thu, 29 Feb 2024 16:52:38 GMT

Hello @Arne Bier ,

Sorry, I forgot some additional details, currently we are running 2.7 on the s 3515, however, we are planning to do the upgrade to 3.0 with the new essential licenses, however, I saw the end of support for the HW on 3515 is in June 2024, we will trying to aquire new hardware, that's why I need to know if we can migrate the new essentials licenses working in the future version 3.0 on the 3515, to the more recent hardware so far. Our environment is air-gapped

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

ahollifield — Thu, 29 Feb 2024 18:26:52 GMT

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-0.html

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/eos-eol-notice-c51-742122.html

Do you have a satellite smart license server? You will need someway for the PAN to talk to the licensing portal.

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

iVicMMac — Thu, 29 Feb 2024 22:03:47 GMT

There is no way to keep the traditional licenses (essentials) as same as Base licenses on 2.7? our environment is totally isolated from internet.

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

Arne Bier — Thu, 29 Feb 2024 22:53:41 GMT

ISE 2.7 supports both licensing types - Traditional (files installed on the PAN) and Smart (PAN talking to Smart Server).

If you are re-homing your Traditional Licenses that were created with the UDIs (Serial Numbers) of the old PPAN and SPAN nodes, then you can re-home those to the new UDIs of the new servers. I have never done it - not sure if there is a webpage to self-serve or if you need TAC.

Re: Re-hosting CIsco ISE SNS-3515 -> SNS-3715

Greg Gibbs — Fri, 01 Mar 2024 00:42:32 GMT

If ISE is completely air-gapped, you will likely need to look at the options around Specific License Reservation (SLR). There is also a Permanent License Reservation (PLR) option, but that is only available for specific industries (like government) and must be approved by the BU. You would need to speak to your Cisco account team regarding the PLR option.

See the Cisco ISE Licensing Guide for more info