Cisco ISE Device Admin Licensing

[Maurice Ball]

Do I need a Cisco ISE device admin license for every PSN I enable the service on?

 For example: If I enabled the device admin service on 5 of my policy nodes. Does this mean I would need 5 device admin licenses installed on the primary admin node?

[Damien Miller · Accepted solution]

Yes, as of ISE v2.4+ you need one L-ISE-TACACS-ND= license per PSN you enable the device admin role on. So enabling device admin on five PSNs would require ordering 5x L-ISE-TACACS-ND=. You then have the option of either putting them in to a smart account ISE can be pointed at, or fulfilling them as a traditional license file and installing it on the admin node.

[Maurice Ball · Accepted solution]

Ok, great. I just wanted to make sure I understood it correctly. Thanks so much for the clarification.

[Mohammed al Baqari]

Hi,

Your device admin license are counted by the number of devices not by the
number of PSN nodes. You PSN nodes consume VM license only. But feature
license can be shared between them.


**** please remember to rate useful posts

[Damien Miller]

Not with ISE.

That was the case with ACS, 500 vs large deployments. ISE 2.4+ licenses both virtual ISE nodes, and tacacs/device admin nodes by the number deployed. 

[Mohammed al Baqari]

Thanks for correcting me Damien.