ISE license count too many relative to wifi devices

[NoobTech]

Our ISE is used to authenticate users on wifi only.

Our license shows 300+ licenses consumed.

Our Wireless LAN Controller shows only 50 devices connected.

I believe we would needed to have have 60 odd "unique" MACs connecting every day for 5 days to reach this license count.

It does not appear to reflect usage.

Can the license usage be re-evaluated more often?

Can I remove older consumed licenses manually?

Other than purchasing additional licenses is there another way to remedy this?

Oh and first post so Hi !  :-)

[Arne Bier]

Hi

this type of question comes up from time to time. The first thing to check is whether you have enabled RADIUS Accounting on your wireless controller? You require RADIUS Accounting to inform ISE of a session begin and end. That is what determines whether licenses are released when sessions end, otherwise ISE would never know. It's also helpful to set the Interim Accounting to 0 seconds (on Cisco WLC it means that WLC will only send an Accounting Interim-Update message when the client's IP address changes) 

[neil.woodhouse]

As Arne says, check interim accounting is properly configured. Without it, stale sessions will remain in ISE for 120 hours (which corresponds to the 5 days that you are seeing)

More info regarding session management can be found here:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html#anc7

[neil.woodhouse]

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html#anc7

[NoobTech]

Thanks for the pointers i'll make some changes today and see how it looks tomorrow.