Impacts of the migration of ISE licenses to Version 3 on existing VMs

[Serge.S DD]

Hello,

We will switch from a VM cluster in version 2.6 to new VMs in version 3.1 (in // of the old one). For this we will transform the existing VMM licenses to VMC and Base/plus to Essentials/Advantage (as indicated on the migration guide).

It seems that the VMM changeover process takes 24/48 hours and is performed before the migration.
What is the impacts on the production cluster during this transformation and configuration migration process?
Is it necessary to install VMM evaluation licenses on the existing VMs during the entire intervention?
For the Base/Plus licenses, transformed into E/A, should they be replaced by evaluation licenses on the existing VMs? And in this case, do these licenses cover all the endpoints concerned?
What happens during a rollback?

Thanks in advanced for your support.

Regards

Serge

[balaji.bandi · Accepted solution]

May be i will approach below :

Build new version ISE 3 cluser (it will give you 90days License) - you can contact License team by quoting that you upgrading to ISE 3.0 or 3.1

Once this is tested working, move your License arrangement with to new ISE VM

then decommission OLD VM

is this works ? or am i misunderstood the requirement ?

[Serge.S DD]

Thanks, Balaji Bandi for your advice.

Regards

Serge

[Damien Miller]

You can convert your VMM to VMC right now without any issue, you can also self service this if you have the VMM and VMC sku's in the same smart licensing virtual account. There is no impact do doing this conversion ahead of time, the VMC licenses can be used with 2.4+. 

The conversion of Base/Plus/Apex to Essential/Advantage/Premier can also be done ahead of or following the upgrade, this is your call. There is a 45 day grace period for out of compliance endpoint session licensing in 2.x and 3.x versions. 

Per the licensing guide located here. https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_licensing.html
"If your license consumption is out of compliance for 45 days, you will lose all administrative control of Cisco ISE until you purchase and activate the required licenses."

Even if the 45 day grace period is exceeded, ISE does not stop processing authentications, you just don't have access to the GUI to modify settings or troubleshoot, you are only able to visit the licensing page..

[Serge.S DD]

Hello Damien Miller,

Thanks for your comments and advices.

Regards

Serge