ISE 2.4 licensing issue "VM License over usage"

[sereagan@cisco.com]

I’ve got a large customer running ISE 2.4. They have licensing for 12 Medium VM’s and I’ve I’ve verified this in the ISE console. They keep getting a “VM License over usage” message saying “Fewer VM Licenses installed than VM Resources/VM Nodes deployed” . All 12 of their VM’s are medium or smaller. TAC has nothing to say other than “buy more licenses” when clearly no more licenses are needed. Anyone seen this yet and have a possible solution?

Thanks

[yshchory · Accepted solution]

Sean,

There is currently a bug (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk09597/) that causes ISE to complain about missing licenses due to an incorrect assessment of the resources. We're tracking the fix to this bug to be part of ISE 2.4 Patch 4 (didn't make it to patch 3 unfortunately) - currently scheduled for end of September / early October.

Yuval

[sereagan@cisco.com]

Thanks Yuval!

[Zivnoah76]

Hey Yuval,

I have installed patches 1 through 4, but still have that warning: "Fewer VM licenses installed than VM resources/VM nodes deployed."

Is there another BUG fix I have missed?

Using ISE 2.4 on a VMWare ESXi 5.5.0.

Could you please guide me how to solve this issue.

Thanks,

Ziv

[Damien Miller]

Ziv,

Did you upgrade to 2.4 form a previous version of ISE?  The vcpu counts in previous vm templates need to be adjusted to fit the 2.4 sizing.

Old 3515 6 vcpu - Needs to become 12 vcpu

Old 3595 8 vcpu - Needs to become 16 vcpu

You can check how ISE is seeing your VM's from the reporting portal, ise counters.  You can also pull this info from the sh tech on the CLI.  If you fit the 16GB/12 vcpu, 64GB/16vcpu, or 256GB/16vcpu (small/medium/large) templates, have the correct licensing installed, but still receive the alarm, then you might be hitting this bug now.  
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk59357 

[Zivnoah76]

Hello Damien,



I did not upgrade and not using 35xx appliances.



I have installed from scratch the 2.4 iso file + 1-4 patches into 1 VM.

How do I know if I have the correct licensing installed and which vcpu templates I need to configure (small/medium/large)? I have purchased "base" + "quantity 100"



Thanks,

Ziv

[Damien Miller]

Have you fulfilled and installed the licenses? If you are using traditional PAK files they will show up on the licensing page. If you are using smart licensing then you need them associated with your account.

https://<your-ise-server>.com/admin/#administration/administration_system/administration_system_licensing

ex. This is 30 medium + 2 large.  

The VM templates you use/build should match the licensing you bought.  They are backwards compatible though, you can use medium licenses for small VM's.  
This page of the install guide coveres the VM requirements based on small (3515), medium (3595) and Large (3595 256GB).
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_01.html

[Zivnoah76]

Hi Damien,

You are right, I was missing one license out of three - the "Small VM License".

I have opened TAC case and they provided me the missing PAK, which hadn't been sent on the original eDelivery Order Notification.

If I had got it all on the first place, then there were no issues at all :(

---

@Damien Miller wrote:

Have you fulfilled and installed the licenses? If you are using traditional PAK files they will show up on the licensing page. If you are using smart licensing then you need them associated with your account.

https://<your-ise-server>.com/admin/#administration/administration_system/administration_system_licensing

ex. This is 30 medium + 2 large.  

The VM templates you use/build should match the licensing you bought.  They are backwards compatible though, you can use medium licenses for small VM's.  
This page of the install guide coveres the VM requirements based on small (3515), medium (3595) and Large (3595 256GB).
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_01.html

---

Thanks  a lot,

Ziv

[hslai]

The bug fix for CSCvk59357 did not make it in ISE 2.4 Patch 4.

[Francisco Sequeira]

Neither did it in Patch 6?

[hslai · Accepted solution]

The fix is part of ISE 2.4 Patch 6. Please note that we would still get warnings but the messages should be clearer on the out-of-compliance status.

Info message: 

"Base/Apex/Plus license was out of compliance for 1 days with last out of compliance N days ago. You are receiving this message because the deployment was out of compliance
for 1 days in the last 60 days"

Critical message:

"Base/Apex/Plus license has been out of complaince for 30 days including today. Please renew or add sufficient licenses to prevent limiting admin access.
End user activity will not be affected."

[hunnymonster]

Seems to be a regression - upgraded from 2.3p6 to 2.6 this week and the exact same issue appears.

[__Beth__]

I just updated 2.4 to patch 8 and am still seeing the same error.  Like you, I wonder if the fix made it to later patches.  

[hunnymonster]

Finally resolved it here by opening a TAC case and getting a new license file (no payment).

Seems to my untrained eye that the size definitions of the VMs has been changed since 2.3 and thus the licenses required are different (which I think is a poor show from Cisco)

[Nayan.Patel85]

Hi,

Quick question on VM license

We have 12 VMs in our deployment - 2 (Admin) + 2 (MnT) + 8 (PSNs).

They all are using 8 CPUs and 64 GB of RAM.

So we have purchased Qty 12 - R-ISE-VMM-K9 licenses.

I am working on a upgrade from 2.3 to 2.4, I have not installed these licenses yet on ISE 2.3.

Que 1 : Do I install licenses on ISE 2.3 before the upgrade or should I install them after the upgrade?

Que 2:  To install licenses we generally specify UID information for Primary and Secondry Admin node. How ever since these Vm licenses are for individual VMs do I need to register the  each license against each VM or should I just do it in same way I do it for Base and Plus license.

Thanks