ISE 2.2 pxGrid licensing for identity to FMC

[gbekmezi-DD]

Table 8 of the ordering guide dated August 2017 includes the following:

The two rows above are a little confusing.  The context sharing row implies Plus license is required for third party sharing.  Is FMC considered third party?  PassiveID implies authentication information coming from other servers.  Does that mean we can't share identity information for radius authenticated users via pxGrid without Plus licenses?

Thanks!

George

[kegagnon · Accepted solution]

Hi George,

Passive ID refers to a work center and is defined pretty well in the Administrator Guide located here: Cisco Identity Services Engine Administrator Guide, Release 2.2 - Manage Users and External Identity Sources [Cisco Ide… In summary, Passive ID is ISE looking to other sources of identity to see if they have authenticated the endpoint. ISE does not actively participate in the authentication itself when Passive identity is used. Active authentication examples include RADIUS and MAB.

I went looking through the Ordering Guide for the words third party and only found one reference. That was for MDM. Passive ID refers to Cisco and non-Cisco subscribers. FMC would be a Cisco subscriber.

Active authentication such as RADIUS would not fall under Passive ID and would therefore fall under the more general Context sharing category. Context sharing requires a Plus license for every endpoint you want to share information about via pxGrid.

I hope this clears things up.

Best Regards, Kevin