Cisco ISE and CSSM-Satellite

[PabMar]

Hello ISE experts,

I know this has been raised in the past. However, throwing the question out there again to see if we are bringing this feature into ISE any time soon.

When will ISE be able to use the CSSM Satellite for smart licensing?

Per config guide it is not supported yet on verson 2.6.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_0110.html#id_24694

I'm bringing this up because when a Virtual Smart account has an existing Satellite, you are not able to create tokens from the Virtual Smart Account itself, you have to do it from the Satellite (see image attached). If you create a token from the satellite but still point ISE to CSSM in the cloud, it won't take the token. I imagine that the organization would need two virtual accounts and transfer the ISE licenses into the VA without a satellite to be able to license ISE accordingly.

Any insight would be appreciated.

Regards,

Pablo.

[howon · Accepted solution]

Please post this to internal PM forum. Thank you.

[Arne Bier]

Hi @PabMar  and @howon 

In ISE, "Transport Gateway" is listed as a third transport option for Smart Licensing.

Interestingly, I was able to point ISE to an on-premise CSSM server using Transport Gateway and it worked ... for a day. And then ISE stopped talking to CSSM.  The TAC eventually told us to use https Connection method instead. But it's interesting anyway to note that the ISE code is halfway there and intends to support CSSM.

Is the Transport Gateway still a supported Cisco solution?  I have never used it but I see the appliance is available for download.

https://software.cisco.com/download/home/282152778/type/283490182/release/4.1.8

Is CSSM replacing Transport Gateway?  If a customer really wants to use Smart Licensing but doesn't want to expose their ISE to the Internet, is this the current recommended solution?

regards

Arne

[Jason Kunst]

Please direct this to the partner community and will have PM answer there. Right now satellite is not supported so you will need ISE to have internet access