ISE licensing

[JACQUES DU PLESSIS]

Hi Guys, I am confused regarding ISE licensing. We want most of the items, including wired, wireless, VPN, Guests, profiling, posture etc.

So a vendor quoted on base + endpoint apex licenses (and anyconnect) and they say that will cover us.

Is this correct since the licensing page suggests we need much more than that?

Thanks!

Jacques

[Marvin Rhoads · Accepted solution]

While you can technically run an ISE deployment with only Base and Apex (and AnyConnect Apex if you aren't using native supplicants) licenses, you typically require Plus licenses also if you are planning to use any of the services it provides (including profiling).

You also need the line items for the server(s) themselves - whether appliance- or VM-based.

[Shaik Moinuddin]

Hi,

ISE posturing feature not supported in VM-based.

regards,

[Marvin Rhoads]

Shaik,

What is your source for that information? I have configured VM-based ISE deployments with posturing enabled and actively in use.

The Posture feature requires Apex licensing (or the old Advanced license for pre-1.3 deployments) but is not limited to physical vs. virtual machine-based nodes.

[Shaik Moinuddin]

hi Marvin,

i found it on Cisco..

ISE Features Not Supported in a Virtual Machine

The Inline Posture node is supported only on Cisco SNS-3415 and Cisco ISE 3300 series appliances. It is not supported on Cisco SNS-3495 series or VMware server systems. All the other designated roles are supported for use on VMware virtual machines.

[Marvin Rhoads]

Shaik,

Inline Posture Node or IPN is not the same as the posture feature.

IPN is used when we need to support posture services and the network access device (typically a legacy firewall) does not support CoA. Under the covers it is a legacy NAC appliance rebranded as an ISE node.

It was rarely deployed. Since ASA software 9.2(1) introduced CoA support, it is becoming even less common.

Posture is part of session services and is supported on VMs across all ISE versions as long as you have the necessary license.

[JACQUES DU PLESSIS]

Yes they came back to me saying we need plus as well. Management would not have been very impressed having to go back to business asking for more money. And yes we are doing the VM

Thanks for the reply

Jacques