ISE base licnese do not released issue

[jefferyshi]

Hello All,

We have ISE (Version 2.6.0.156) authenticate anyconnect remote VPN and TACACS for network devices(Total 36 devices including Cisco ASA, routers, and switches).

Actually, we don't have much remote anyconnect vpn client, less than 100. but the ISE base license always exceeds 200.  Looks ISE don't recycle the timeout or inactivity users to release base license.

As I understood,  A Base license is consumed for every active session. Once the session ends, the license is released for reuse by other users. The 200 base license should be enough. 

Checked "Current Active Sessions" is 26.  Normally "Current Active Sessions" is under 50. It's confuse me why take more than 200 base license.

 I need help with how the ISE is able to clear the inactivity/timeout user and free base license for new users?

Thank you so much!

Jeffery

[Karsten Iwen]

Is the accounting-config in place?

tunnel-group DefaultWEBVPNGroup general-attributes
 authentication-server-group ISE
 accounting-server-group ISE

[jefferyshi]

Yes, accounting-config in place for any connection users.

tunnel-group SSLVPN type remote-access
tunnel-group SSLVPN general-attributes
address-pool SSLVPN_POOL_1
authentication-server-group ISERadius LOCAL
accounting-server-group ISERadius
default-group-policy SSLVPN_Policy

Thanks

jeffery