ISE device admin Licnese

[infome]

Hello 

I want to implement ISE in a network. Right now I want device administration TACACS to use, moreover; I want perpetual licenses.

• Do I need R-ISE-VMC-K9= License?
• Do I need a Device administration license (L-ISE-TACACS-ND=)?
• OR do I need both?
• I have between 600 devices in my network do I need to buy endpoint licenses for TACACS?

[liviu.gheorghe]

Hello @infome ,

Yes, you need the R-ISE-VMC-K9= License which is the VM license for the ISE deployment in a virtualised environment

Yes, you need the ISE Device Admin license L-ISE-TACACS-ND= if you plan on using TACACS

Yes, you need both R-ISE-VMC-K9= and L-ISE-TACACS-ND=

If you have 600 endpoints you have to buy 600 ISE-A-LIC (ISE Advantage Subscription).

The R-ISE-VMC-K9= and L-ISE-TACACS-ND= are perpetual licenses and ISE-A-LIC are subscriptions.

[infome]

thanks @liviu.gheorghe 

if you check below and give your advise 

[liviu.gheorghe]

Yes, that is correct - you need a TACACS license for each PSN. The same goes for TACACS not consuming Endpoint licenses and that there is no limit to how many devices you can administrate with TACACS.

Yes, Essential, Advantage and Premier are subscription licenses and license consumption is based on active endpoint sessions.

[infome]

Thanks

So I need to Buy (R-ISE-VMC-K9= and L-ISE-TACACS-ND=) Licenses for network device administration.

In my case I do not need to buy  ISE-A-LIC  because I do not use ISE as a AAA.

Sorry if I am not getting it right.  

[liviu.gheorghe]

Now I'm confused - in the original post, you said you want to use TACACS. The TACACS protocol is part of the AAA framework. Do you mean that you want to use the ISE server solely as a TACACS server? For this use case you need to buy the Essential license ISE-E-LIC. Can you clarify?

ISE Essentials:

ISE Essential is the base licensing tier that provides fundamental identity and access management features. It includes functionalities such as 802.1X-based network access, guest access management, posture assessment, and basic profiling capabilities. This tier is suitable for organizations looking for essential security features to control access to their network resources.

[Marvin Rhoads · Accepted solution]

Thew two licenses you mentioned in your original post are the only ones you need to TACACS on an ISE VM. If you want high availability then you would need two VMs and two each of those two license types.

If by "600 devices" you mean 600 switches. routers etc. using TACACS then no further license are required.

Essentials / Advantage / Premier licenses are only required when you have devices authenticating via RADIUS and you need that feature along with other optional advanced features (like profiling, BYOD registration, posture checking etc.)

Note: Some deployments without the need to authenticate end user computers (i.e,, only having only network infrastructure devices requiring authentication) end up requiring a few Essentials licenses to support any network devices that don't have TACACS support built in.

[infome]

Thanks @liviu.gheorghe & @Marvin Rhoads  for explaining ISE licensing. 

I will try to buy these Licenses as you know that these licenses are expensive that is Why I want to be well prepared. before I  buy these Licnese, is there any trial License which I can install in my network.  

• R-ISE-VMC-K9=
• L-ISE-TACACS-ND=

[liviu.gheorghe]

Yes, any new installation has a 90 day trial period with all features activated for 100 endpoints as far as I recall.