Cisco ISE Device Admin License for Multiple Deployment

[Davesh.Borasi]

Hi,

I was going through some cisco design and ordering documents for ISE Device Administration licensing for our Customers.

We have two Deployments as below:

1) LAB setup - One PAN (Admin + MnT) / 3 PSN Nodes with Device Administration only

2) Production Setup - PAN (Primary / Secondary (Admin+ MnT) ) + 6 PSN Nodes for Device Administration only

Now as per my understanding from ISE Ordering guides and Deployment guide,

We would need Two Device Admin Licenses:

One PAK File for LAB setup using PAN UID / Serial Number etc

Second Device Admin License PAK File for Production Setup for Primary and Secondary UID. Import generated PAK to Primary PAN and it will be pushed to Secondary PAN.

But During training sessions for ISE, the trainer said we need Three Device Admin Licenses.

One For LAB PAN,

Second for Production PRIMARY PAN

Third for Production Secondary PAN

Now this has confused us further? Can someone clarify if we need Two Device Administration License or Three Device Administration License.

[Jatin Katyal · Accepted solution]

Only a single Device Administration license is required for the entire ISE deployment so you need 2 device administration licenses. One for LAB and one for production.

Q. Do I need an ISE Device Administration license for every ISE appliance or every ISE deployment?

A. No. The ISE Device Administration license is a deployment wide license and therefore not something that gets added to every ISE appliance in the deployment. The ISE Device Administration license gets applied at the main administrative node, which in turns enables device administrative services throughout the ISE deployment. The Device Administration license requires at least 100 Base Session License. The ISE Device Administration license only needs to be ordered for the ISE deployment or deployments where device administrative services are needed. For example if there are two ISE deployments - one for endpoint access and another for device administration - then only one ISE Device Administration license is needed and would only be added to the device administration ISE deployment cluster.