07-10-2017 10:29 PM
Hi Members,
Could someone assist me how to upload ISE license?
We are running ISE 1.3 and our licenses expired.
Cisco provided us with 60 days temporary licenses (Zip File).
Would restart be required once we import the license?
Solved! Go to Solution.
07-10-2017 10:37 PM
No, no restart required. You may have to log out and log back in if GUI elements need to be updated. Unzip the file and upload the license file(s) the zip file contains. The instructions are well documented. Step 5 here: http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2
George
Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.
07-10-2017 10:37 PM
No, no restart required. You may have to log out and log back in if GUI elements need to be updated. Unzip the file and upload the license file(s) the zip file contains. The instructions are well documented. Step 5 here: http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2
George
Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.
07-10-2017 10:39 PM
Thanks George.
I was concerned if I'd have to restart the box.
I'll give it a try and will update the post.
Thanks again.
07-11-2017 03:19 PM
If you have a secondary PAN you need to apply the license to the Secondary as well (of course, the license has to be generated with the UDI of the Secondary, or else it doesn't match). And getting a license onto a Secondary PAN requires deregistering the node, apply license, and then registering again. At least that is my experience in ISE 2.1 & 2.2.
07-13-2017 09:50 PM
Hi Arne,
So we provided Cisco the Primary and Secondary PANs UDIs and they provided us with a license file.
Do we need to apply the same file to both Primary and Secondary PANs?
07-13-2017 09:58 PM
Hi Moin
yes indeed. The same license file(s) should contain the UDI details of both PAN nodes. You can open the files with a text editor to have a look (look for strings <PrimaryUDI> and <secondaryUDI>).
Applying licenses only works when the node is in STANDALONE or PRIMARY node. This means if your Secondary PAN is registered, it will be SECONDARY - you will have to deregister it first, apply license, and then register it again.
07-13-2017 10:02 PM
So here's what I should do?
1. De-register Secondary PAN.
2. Apply license to Primary PAN.
3. Apply license to Seondary PAN. (same license file)
4. Register Secondary PAN with Primary.
07-13-2017 10:08 PM
Yup. Same file is used on both servers.
If you still have your eval licenses in place then I would delete those as well. Not sure if they automatically get removed from the system after 90 days (I would hazard a guess and say "no"). But mostly because having those eval licenses hanging around will enable features that you don't want/are entitled to (e.g. Assuming you only purchased BASE, then your menu options will change once you delete the eval Plus license). No idea what happens when eval licenses are left lying around after 90 days. Perhaps the menus will automatically adapt to the new (reduced) feature set.
cheers
07-13-2017 10:11 PM
We had wireless only license which expired. Cisco issued with 60 days temporary licenses to us.
L-ISE-W-S-500=
Also, I just checked the license file, it has exactly similar Primary and Secondary UDIs.
Should I check back with Cisco?
07-13-2017 10:20 PM
Not sure about the circumstances of how you got those licenses - probably best to check with Cisco. If it's just a demo type license then I would not worry about it. But if it's for production, and you want your Secondary PAN to actually have a license for that instance when you have to fail over to it (usually that is not the best time to realise you have no license on your Secondary!!!) then get it sorted out now.
If it was a purchased licensed with a PAK, then in theory you can amend (re-home) a license in the Cisco licensing portal. I tried that and it didn't work - eventually opened a support ticket with Cisco licensing and they sorted it out pretty quickly.
07-13-2017 10:23 PM
Thanks mate, I'd check with Cisco as it's a production environment.
But the license file must have different UDIs for Primary and Secondary, right?
07-13-2017 10:33 PM
Yes. When you try to upload the license to a PAN node, where the UDI does not match, then the license import will fail.
You can get the UDI from each PAN via CLI
show udi
Part of the license file looks like this
<PrimaryUDI>ISE-VM-K9:V01:E9********4</PrimaryUDI><secondaryUDI>ISE-VM-K9:V01:MFF******A</secondaryUDI>
07-13-2017 10:39 PM
Thanks mate, I'll check with Cisco and will update the post.
07-14-2017 04:39 AM
In an ISE deployment, just import the license files to the primary ISE node. There is no need to import them to the secondary admin node so please DO NOT deregister an ISE node solely to import licenses.
secondaryUDI
is optional and is there if you would like a redundancy for licensing in case later the 2nd PAN promoted to primary and in case you need to reimport the licence files for some reason.
07-16-2017 01:44 AM
Is this true for ISE 1.3 as well?
If we need redundancy, do I need to import license to secondary node as well?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide