topic Re:License usage in Network Access Control

License usage

bikespace — Mon, 11 Mar 2019 03:45:54 GMT

Hi Folks,

Well I thought I was pretty happy with licensing, and what I understood was:

1. Licensing is based on number of concurrently active users.

2. An advanced license is used if an endpoint is allocated an authentication profile based on a rule which uses profiling information/posturing.

This shows my currentl licensing page:

and here's a summary from the front page:

Don't these two already contradict each other?

I've no idea where 28 advanced licenses have been used. No posturing in place, fairly simple setup, dot1x certs and MAB. Any tips for troubleshooting license usage?

Ver 1.1.4 Patch 3

Re:License usage

Tarik Admani — Tue, 13 Aug 2013 14:07:15 GMT

You are correct. Are you using any advanced guest features like device provisioning? If not, you need to run this through tac.

Sent from Cisco Technical Support Android App

Re:License usage

bikespace — Tue, 13 Aug 2013 22:20:12 GMT

No device provisioning. I do have profiling enabled, but I'm thinking that if I'm not using attributes gained from profiling for any authorization rules, then it shouldn't be using advanced licenses. The fact that I only have 7 profiled end points showing on the home page sort of makes me feel more comfortable that I haven't got that wrong.

Re:License usage

Ravi Singh — Wed, 14 Aug 2013 02:16:12 GMT

I would suggest you to open a case with TAC team. TAC will help you out in this scenario.

Re:License usage

blenka — Thu, 15 Aug 2013 00:10:50 GMT

Table 4 Cisco ISE License Types and Supported Services (for ISE licensing information)

http://www.cisco.com/en/US/docs/security/ise/1.0.4/release_notes/ise104_rn.html#wp62171

The configuration guide that will help you to configure & monitor the staus of endpoint.

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_ug.pdf

Re:License usage

bikespace — Thu, 15 Aug 2013 01:05:55 GMT

Hi Basant, I might have missed your point. Were you outlining anything in particular? Or just handing me the manual? 🙂

License usage

Florian Brenner — Sun, 17 Nov 2013 16:00:56 GMT

bikespace, did you ever get a solution for this issue?

I'm having the same problem in my current ISE implementation.

License usage

Naresh Ginjupalli — Tue, 19 Nov 2013 18:12:21 GMT

bikespace,

In ISE 1.1.x, Advanced license is the count of postured, BYOD, or profiled endpoints that are active in session directory.

You can make use of this API reference guide to check the Active session count.

http://www.cisco.com/en/US/docs/security/ise/1.1/api_ref_guide/ise_api_ref_ch2.html#wp1068744

The API to check for Active Session count is as follows :

https://MNTise-node-name/ise/mnt/Session/ActiveList

Looks like issue with Dashboard query . Dashboard might be taking the count of stale Endpoint sessions as well.

Re: License usage

bikespace — Thu, 28 Nov 2013 17:34:22 GMT

Reply from TAC was that there were internal discussions regarding whether the method in which the licensing was calculated is to be changed, or Cisco's wording in the documentation is to be changed.
I hear that it's the former but no news regarding when yet.
Confirmed that it doesn't perform as per the documentation.
End points which were manually added by MAC were subsequently being marked as profiled and using an advanced license, despite the rules which they are using not using any of the profiled information.
Cosmetic but sends annoying alarms constantly. Doesn't look too good.

Sent from Cisco Technical Support iPhone App