Cisco ISE registration Failed !!

[Ditter]

Hi to all,

i started getting the messages you see at the bottom of the thread in my ISE 2.7.0.356 with patches 1,2,4 installed.

I downloaded a new token in order to register the system, but nothing changed. I also deregistered and registered the system , nothing changed also.

The funny thing is that it mentions "Evaluation period of Smart Licensing has expired." probably due to deregistration/registration i did.

I recall in the past there were some changes in cisco server and there was a certificate issue, maybe the same situation holds true about ISE?

The system worked just fine 5 years now in conjunction with smart software central.

Any help appreciated.

Thanks

Ditter.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Alarm Name :
Smart Licensing Evaluation Period Expired

Details :
Smart Licensing evaluation period expired: Details=Smart Licensing evaluation period expired

Description :
Evaluation period of Smart Licensing has expired.

Severity :
Critical

Suggested Actions :
Refer to the ISE License Administration page to register ISE with Cisco Smart Software Manager.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

[Ditter]

Hi to all,

i started getting the messages you see at the bottom of the thread in my ISE 2.7.0.356 with patches 1,2,4 installed.

I downloaded a new token in order to register the system, but nothing changed. I also deregistered and registered the system , nothing changed also.

The funny thing is that it  mentions "Evaluation period of Smart Licensing has expired." probably due to deregistration/registration i did.

I recall in the past there were some changes in cisco server and there was a certificate issue, maybe the same situation holds true about ISE?

The system worked just fine 5 years now in conjunction with smart software central.

Any help appreciated.

Thanks

Ditter.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Alarm Name :
Smart Licensing Evaluation Period Expired

Details :
Smart Licensing evaluation period expired: Details=Smart Licensing evaluation period expired

Description :
Evaluation period of Smart Licensing has expired.

Severity :
Critical

Suggested Actions :
Refer to the ISE License Administration page to register ISE with Cisco Smart Software Manager.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

[balaji.bandi]

check here most of the FN:

https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-field-notices-list.html

check the communication to the cisco License Server and verify the settings again :

suggested steps :

 in Administration > System > Licensing try to:

1. update the Smart Licensing Registration ... clicking the Update button

2. deregister and register the Smart Licensing (you will need the Registration Token for that)

Note: pay attention to your Smart Licensing Registration - Connection Method (Direct HTTPS, HTTPS Proxy or Transport Gateway).

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/m_ise_man_license.html

The bug should have fixed by now :

CSCwa13877 : Bug Search Tool (cisco.com)

[Ditter]

Thanks for the help. I did the deregister/reregister procedures again. What is strange is that for example it mentions TACACS+  evaluation expired and when i do a disable/enable this specific tacacs+ license then it shows correctly , IN COMPLIANCE.

One moment it is in state evaluation expired and the next moment after a disable/enable it gets its normal state which is in compliance

Is there by any chance a problem with certificates?  Or maybe i should have a speicific certificate in the ISE repository?

Thanks,

Ditter.

[ahollifield · Accepted solution]

I would personally install the latest 2.7 patch before spending anymore time troubleshooting this issue.

[Ditter · Accepted solution]

Patched the cluster to latest 9 patch and registration is now success.  I believe that part of the latest update contains updated info about trusted certs and now ISE registers OK.

The only problem that remains is that although i have several thousands base licenses in my smart account they do not show in the ISE licensing page , nevertheless the tacacs+ licenses show correctly.

The base license is Enabled but with Released Entitlement and 0 count.

Any ideas about that?

Thanks,

Ditter.

[ahollifield]

Do you have RADIUS Accounting enabled on your NADs?  It can also take time for the licensing dashboard to properly populate.

[Ditter]

Thanks for the answer,

yes i have radius accounting active and after one day , i have radius clients and dot1.x clients coming in and out the network,  the base licence count increases and decreases accordingly but at the cisco software central the licenses stay steady at the initial amount that was purchased , i mean that the license count should decrease according to the clients that have used the resources of the ISE for authentication/authorization via the radius services. 

Probably the reason is that i use the ISE as a proxy radius??  I do not really know.

Anyway,

Thanks 

Ditter.

[ahollifield]

So ISE isn't terminating any RADIUS sessions?  It's proxy to an external RADIUS server?

[Ditter]

For most of applications yes, it acts as a proxy radius.

But regardless of that shouldn't i have under Administration--> Licensing the total number of base licenses i have purchased?

It still shows under Compliance "Released Entitlements." 

Shouldn't this be "in compliance"? 

As i mentioned the smart account is populated correctly with the total amount of licenses.

[ahollifield]

So your Essentials licenses show “released” you need to activate the license on ISE on the licensing page. Also though, I don’t think RADIUS proxy actual consumes any licenses though