Team,
On of my customers is observing issue with ISE 1.3 patch 5 where ISE doesn't show correct count for active endpoints and it affects licensing. I found out that it is bug and resolved in ISE 1.3 patch 6. I am testing licensing and active endpoints in my LAB to verify and confirm if this issue is resolved in patch 6 before communicating with customer. I have created very simple setup which includes following:
1. ISE 1.3 Patch 6 (Evaluation License)
2. Virtual WLC
a. Dot1x SSID
b. Session timeout - 5 mins
c. 8.0 version
3. ISE Policies
a. Default Authentication policy
b. Authorization policy --- Condition: 1. protocol: PEAP-MSCHAPv2, 2: Part of particular AD group ------ Permission - Permit any
Following are observations:
Session Starts:
1. When session starts, ISE shows Active endpoint as 1 - As expected
2. In live sessions tab, I can see, radius account start request and authentication succeed. - As expected
3. However licensing tab does not show a single license is being consumed. - According to me, ISE should show license consumed when session starts and authenticates
4. ~20 mins after session starts, I saw that one base and plus license is being used. - It should use only base license as I have not referring any advance attributes
Session Terminated:
1. I disabled WIFI on client, remove client from WLC
2. I saw that session is terminated in ISE - Live session Tab.
3. Active endpoints are showing Zero
4. But licensing tab was still showing 1 base and 1 plus licensed is being used. Around After 20 mins, license count became zero and Live session log got cleared.
Could you please help me to understand the relation between Active endpoints, License consumed and Live session logs as I am confused because of above observations. Is it expected behavior or is licensing broken? I have attached screenshots from ISE for your reference.
Thanks,
Neelesh Marathe
The tool-tip next to the updated timestamp in the licensing page shows the data refreshed every 30 minutes.
