Bypass certain IP Phone MAC addresses to avoid ISE license count

[eritsoi]

Hi ISE expert,

Just wonder if there is a way to exclude certain IP Phone MAC addresses from ISE license consumption?

• Disable RADIUS auth, which is not applicable, will impact all other devices connected to the port.
• Return Access-Reject is not an option as IP Phones must be connected.

Is Guest-VLAN something that can be used to exclude MAC addresses from ISE license consumption or there is no better way of excluding IP Phones from license consumption without impacting others? (will post this in the ISE community)

Thanks,

Eric

[Jason Kunst · Accepted solution]

Base licensing is cheap buy more licenses

Otherwise you would have to uncontrol the port and not have it managed by ise, if you have pcs behind them then you would lose the controls of ise as well

Not sure of other way

What is the need? To simply save money?

[howon]

Two possible options I can think of.

- CDP bypass: This is legacy way of supporting IP Phones and support may be spotty on newer switches but last I heard we are brining back CDP bypass due to customer demand for very reason you cited however, certain switches may not support this

- Auto Identity with IBNS 2.0

Hosuk