ISE 2.4 VM license downwards compatible?

[Arne Bier]

Hello

trivia question: will ISE 2.4 accept a R-ISE-VMM-K9 license (aka 'Medium VM spec') on an ISE node that is running say, 8GB or 16GB RAM and just 2 cores?   Strictly speaking that node should have a R-ISE-VMS-K9 (Small) license. 

But it makes sense to at least have the ability to run a more expensive license on a smaller VM, right? 

Anyone done this or, is able to confirm please?

[hslai]

Yes. VM Small is for RAM 8-GB to <= 16-GB and CPU cores <= 6 cores.

[Arne Bier · Accepted solution]

The question was whether a Medium license would work on a small spec VM - it seems the licenses are downwards compatible (or as Cisco calls it, "License Substitution") - below is a snip from the Smart Licensing Portal

So I thought I would share this by way of example.

I installed ISE 2.4 and patched to patch 1.  I have three nodes in my deployment, all small spec VM's.  After I registered the deployment in Smart Licensing, I see this in the Smart Licensing portal

And ISE GUI reports this

After I allocated 3 VMM (Medium) licenses to my ISE Virtual Domain, the situation improved (you can see how the substitution works below)

So it's all good.  Phew!

Well - sort of.  The scenario above uses the Smart Licensing in the Cisco cloud.  But what happens when you have to use a Satellite Server instead (ISE calls this Transport mode)?    It doesn't work in the Satellite server version 5.0.1 that I am using.  Below is an example of 5 SMALL_VM nodes that registered to the Satellite server - Satellite server demands that I have Small license and doesn't care about the substitution.

Although, when I view the Satellite server in the Cisco Cloud portal, the logic there is correct.

Smart Licensing works great when going direct.  The Satellite method is still somewhat buggy, and relies on Smart Call Home etc.

[hslai]

Thanks a lot for sharing.

[Arne Bier]

Hello hslai

I have one more question about this topic.  In our discussions above I was able to demonstrate how License Substitution works in the case of Cisco Smart Licensing portal.  In that example I had purchased Medium license, but my system used Small VM resources, and in that case Substitution worked well.  All good.

My question is this:  does this also work in the case of a manually created license?  In other words, does this apply when NOT using Smart Licensing as well?   e.g. I purchase a Medium VM PAK and create a license with the UDI etc on the Cisco Licensing Portal.  Will the ISE 2.4 patch 1 node be able to substitute that Medium license for a Small license, or do I have to purchase a Small license instead?

My node has 16GB RAM, 4 CPU's (ISE reports "4 cores") and as a result it's classified as ucsSmall - does that also translate to a VM Small??? 

*****************************************

Displaying ISE Profile ...

*****************************************

Profile : ucsSmall

Is there a table that shows the VM License categorisation vs the node Profile?

Craig Hyps's BRKSEC-3699  has a table that shows the available Profiles, but his table doesn't tie this to the eventual VM License that's required.

And until you actually install a VM license in your ISE 2.4 node, I cannot find anywhere in the Admin GUI that tells me what VM License I require (other than I am out of compliance) - this could be made a bit more intuitive.

[hslai]

... My question is this:  does this also work in the case of a manually created license?  In other words, does this apply when NOT using Smart Licensing as well?   e.g. I purchase a Medium VM PAK and create a license with the UDI etc on the Cisco Licensing Portal.  Will the ISE 2.4 patch 1 node be able to substitute that Medium license for a Small license, or do I have to purchase a Small license instead?

With traditional licensing, this is done implicitly. That is, the VM licenses will entitle ISE nodes with the same VM category or smaller.

My node has 16GB RAM, 4 CPU's (ISE reports "4 cores") and as a result it's classified as ucsSmall - does that also translate to a VM Small??? 

*****************************************

Displaying ISE Profile ...

*****************************************

Profile : ucsSmall

Is there a table that shows the VM License categorisation vs the node Profile?

Not currently, but will be addressed by CSCvk09597, planned for ISE 2.4 Patch 3, and then the VM licenses and profiles will match, other than EVAL, which will be under the small VM category.