topic Re: Device Admin license in Cisco ISE in Network Access Control

Device Admin license in Cisco ISE

Fares7 — Tue, 25 Mar 2025 07:41:34 GMT

Hi Guys

I am using Cisco ISE running on version 3.2.0.542 with distributed deployment.

there are 2 PANs primary and secondary with 3 PSNs in different locations.

I got the tacacs license to activate the device admin and enable the admin authentication to be centralized and controlled by ISE.

My question is, what the procedure of activating the license in the appliance? do I have to deploy it in the Primary PAN only and it will replicate? or I have to deploy it in all nodes one by one? does it require a down time?

Re: Device Admin license in Cisco ISE

ahollifield — Tue, 25 Mar 2025 14:53:22 GMT

Yes PAN only. Then enable the Device Admin service on whichever PSNs you want.

Re: Device Admin license in Cisco ISE

Ambuj M — Tue, 25 Mar 2025 16:03:35 GMT

what the procedure of activating the license in the appliance?

You don't need to do anything, for this version Cisco smart licensing is mandatory, which I am sure you have it enabled, your smart licensing portal will have your device admin licenses in the pool.

do I have to deploy it in the Primary PAN only and it will replicate? I have to deploy it in all nodes one by one? does it require a down time?

you will click on specific PSN under deployment on PAN and check "Enable Device Admin Service". It will not reload the server, it will just show a message "node has been updated"

Re: Device Admin license in Cisco ISE

Fares7 — Wed, 26 Mar 2025 07:39:02 GMT

Regarding the smart license, I can see that the tacacs license is not smart license. when I logged in to cisco portal, I can see it is appearing under the list of (convert to smart license). Also, in the PAN node license page I don't see the device admin license appearing there.
I am attaching the license file we received from partner too.

Please check attached screenshots and guide me please

Re: Device Admin license in Cisco ISE

ahollifield — Wed, 26 Mar 2025 08:28:44 GMT

You need to click the convert to smart button. Or open a licensing TAC case.

Re: Device Admin license in Cisco ISE

Sven Hruza — Wed, 26 Mar 2025 10:36:01 GMT

You can convert the tacacs license to smart license like every other license for ISE.
It worked for me straight forward.
After this is done your ISE server should take it and add as much licenses as needed in your deployment.

Re: Device Admin license in Cisco ISE

Fares7 — Wed, 26 Mar 2025 11:02:37 GMT

Thanks, it worked for me. I think the license covers only one node while I have three other nodes. Do I need to purchase extra license same quantity of the device admin nodes?

Re: Device Admin license in Cisco ISE

ahollifield — Wed, 26 Mar 2025 11:48:44 GMT

you don’t have to if one license fits your needs. But yes the drive admin license is per node. If you want it on all three nodes; you will need to make a purchase