topic Re: ISE device admin Licnese in Network Access Control

ISE device admin Licnese

infome — Wed, 27 Mar 2024 20:57:46 GMT

Hello

I want to implement ISE in a network. Right now I want device administration TACACS to use, moreover; I want perpetual licenses.

Do I need R-ISE-VMC-K9= License?
Do I need a Device administration license (L-ISE-TACACS-ND=)?
OR do I need both?
I have between 600 devices in my network do I need to buy endpoint licenses for TACACS?

Re: ISE device admin Licnese

liviu.gheorghe — Wed, 27 Mar 2024 22:13:17 GMT

Hello @infome ,

Yes, you need the R-ISE-VMC-K9= License which is the VM license for the ISE deployment in a virtualised environment

Yes, you need the ISE Device Admin license L-ISE-TACACS-ND= if you plan on using TACACS

Yes, you need both R-ISE-VMC-K9= and L-ISE-TACACS-ND=

If you have 600 endpoints you have to buy 600 ISE-A-LIC (ISE Advantage Subscription).

The R-ISE-VMC-K9= and L-ISE-TACACS-ND= are perpetual licenses and ISE-A-LIC are subscriptions.

Re: ISE device admin Licnese

infome — Fri, 29 Mar 2024 09:39:01 GMT

thanks @liviu.gheorghe

if you check below and give your advise

Re: ISE device admin Licnese

liviu.gheorghe — Fri, 29 Mar 2024 10:03:49 GMT

Yes, that is correct - you need a TACACS license for each PSN. The same goes for TACACS not consuming Endpoint licenses and that there is no limit to how many devices you can administrate with TACACS.

Yes, Essential, Advantage and Premier are subscription licenses and license consumption is based on active endpoint sessions.

Re: ISE device admin Licnese

infome — Fri, 29 Mar 2024 10:20:26 GMT

Thanks

So I need to Buy (R-ISE-VMC-K9= and L-ISE-TACACS-ND=) Licenses for network device administration.

In my case I do not need to buy ISE-A-LIC because I do not use ISE as a AAA.

Sorry if I am not getting it right.

Re: ISE device admin Licnese

liviu.gheorghe — Fri, 29 Mar 2024 10:33:24 GMT

Now I'm confused - in the original post, you said you want to use TACACS. The TACACS protocol is part of the AAA framework. Do you mean that you want to use the ISE server solely as a TACACS server? For this use case you need to buy the Essential license ISE-E-LIC. Can you clarify?

ISE Essentials:

ISE Essential is the base licensing tier that provides fundamental identity and access management features. It includes functionalities such as 802.1X-based network access, guest access management, posture assessment, and basic profiling capabilities. This tier is suitable for organizations looking for essential security features to control access to their network resources.

Re: ISE device admin Licnese

Marvin Rhoads — Fri, 29 Mar 2024 12:33:35 GMT

Thew two licenses you mentioned in your original post are the only ones you need to TACACS on an ISE VM. If you want high availability then you would need two VMs and two each of those two license types.

If by "600 devices" you mean 600 switches. routers etc. using TACACS then no further license are required.

Essentials / Advantage / Premier licenses are only required when you have devices authenticating via RADIUS and you need that feature along with other optional advanced features (like profiling, BYOD registration, posture checking etc.)

Note: Some deployments without the need to authenticate end user computers (i.e,, only having only network infrastructure devices requiring authentication) end up requiring a few Essentials licenses to support any network devices that don't have TACACS support built in.

Re: ISE device admin Licnese

infome — Fri, 29 Mar 2024 14:26:21 GMT

Thanks @liviu.gheorghe & @Marvin Rhoads for explaining ISE licensing.

I will try to buy these Licenses as you know that these licenses are expensive that is Why I want to be well prepared. before I buy these Licnese, is there any trial License which I can install in my network.

R-ISE-VMC-K9=
L-ISE-TACACS-ND=

Re: ISE device admin Licnese

liviu.gheorghe — Fri, 29 Mar 2024 14:33:57 GMT

Yes, any new installation has a 90 day trial period with all features activated for 100 endpoints as far as I recall.