ISE License Consumption

[chesgreen]

I currently only have ISE integrated with my wireless environment. I currently have 500 licenses and at any given moment may have 300-420 users connected, but ISE consistently shows over 500 active sessions which keeps me out of compliance. How does ISE count active sessions, am I missing something. The WLCs are running the suggested software and I have confirmed that they are sending start-stop messages to ISE. Why are the active users on the WLCs reflecting a different number of active sessions in ISE?

[Marcelo Morais · Accepted solution]

Hi @chesgreen 

 licenses are counted against Concurrent Active Sessions and a session starts with a RADIUS Accounting Start message !!!

Note: ISE will maintain a session as active for 5 days unless one of three things happens.
1. An Interim Accounting packet is sent by the SW/WLC telling ISE that the Endpoint is still connected and active.
2. A Reauthentication of the Endpoint happens, this results in a new accounting start, and the 5 day timer resets.
3. A RADIUS Accounting Stop message is received by ISE, the session is no longer active and the license will be released.

Please take a look at:

Operations > Reports> Reports > Endpoints and Users > Current Active Sessions

Hope this helps !!!

[chesgreen]

I checked and I am getting start stop messages from the WLCs.

[ahollifield]

Do you have RADIUS accounting enabled for a WLAN which isn't using ISE for anything?  For example a PSK SSID?

[hslai]

You might hit some known issues; e.g. CSCvo61351 or CSCvg50777

[Marcelo Morais]

Hi @chesgreen 

 at

Operations > Reports> Reports > Endpoints and Users > Current Active Sessions

 export the result to a repository and compare with:

Administration > System > Licensing

 Please check if there is a match and also if you are able to find anything odd on the active sessions list.

Hope this helps !!!

[jvujcich]

Yes, I have this problem too. And we probably purchased more licensing without having too.

Under  

Under "Operations > Reports> Reports > Endpoints and Users > Current Active Sessions" we see 2721 connections.

But under "Administration > System > Licensing" we see 5238 current connections. And now ISE is reporting we are "Out of Compliance"

[Marcelo Morais · Accepted solution]

Hi @jvujcich ,

 please try to Reset the M&T Session Database:

ise/admin# application configure ise
Selection configuration option
[1]Reset M&T Session Database
...

Hope this helps !!!

[jvujcich · Accepted solution]

Thanks Marcelo, That worked.