How Cisco ISE 1.2 Base licenses are consumed and tracks concurrent endpoint connected to network

[kmittal]

Hello

I am interested to know how the cisco ISE 1.2 base licences are consumed. As the cisco ise 1.2 user guide "The Base License is consumed whenever an authentication notification is received by Cisco ISE."

Based on the above statement i have following queries :-

Radius being the UDP based request, its only during the time endpoint is authenticated and authorized the base license is consumed and then its is released. Then how does cisco ISE tracks the concurrent endpoints connected to the network.

Thanks

Kumar

[Tarik Admani]

All licensing in ISE is tracked by every radius authentication request.

Proper accouting of all licenses consumed relies on radius accounting for a proper count of all current radius connections.


Sent from Cisco Technical Support Android App

[kmittal]

thanks for the reply Tarik.

As I understand, you mean that a base license is consumed by every radius authentication request and then the license is free to be utilised again

Also would this means if Radius accounting is turned off, then concurrent sessions will not be tracked.

Thanks

Kumar

[cciesec2011]

I am going to tell you a little secret about Cisco license count.  According to Cisco documentation:  http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_man_license.html#wp1074423, it states:

License Count

The Cisco ISE license is counted as follows:

•A Base or Advanced license is consumed based on the feature that is utilized.

•An  endpoint with multiple network connections can consume more than one  license per MAC address. For example, a laptop connected to wired and  also to wireless at the same time. Licenses for VPN connections are  based on the IP address.

•Licenses  are counted against concurrent, active sessions.  An active session is  one for which a RADIUS Accounting Start is received but RADIUS  Accounting Stop has not yet been received.

---

Note Sessions  without RADIUS activity are automatically purged from Active Session  list every 5 days or if the endpoint is deleted from the system.

---

To  avoid service disruption, Cisco ISE continues to provide services to  endpoints that exceed license entitlement. Cisco ISE instead relies on  RADIUS accounting functions to track concurrent endpoints on the network  and generate alarms when endpoint counts exceed the licensed amounts:

•80% Info

•90% Warning

•100% Critical

Based on this assessment, you can purchase an ISE with 100 endpoint license and use the ISE to support 2000 endpoints without any issues because the license is not strictly enforce.  Yes, it will generate alarms but it still works

[Tarik Admani]

Kumar,

The radius accounting allows ISE track the proper count of endpoints. If you do not enable radius accounting, you will see a growing number of endpoints which can lead to unecessary alarms.

Thanks,

Tarik Admani
*Please rate helpful posts*