ISE licensing

[savva135]

In my organization we are only allowed to use up to ISE version 2.2. If we bought a license for version 2.3, would we be able to use it to install and activate version 2.2?

Second question is that I am reviewing the purchase order and noticed that there are two items on it that confuse me. ISE 5 bundle VM (ise-5vm-k9) and ise virtual machine image (ise-vm-k9). Are these basically the same? We want to stand up 4 servers. Would we be fine with just the 5 bundle vm sku?

[Ben Walters · Accepted solution]

ISE licensing works regardless of version so you can buy your licences (base, plus, apex) and it will work with whatever version you are using for ISE.

As for the VM licenses they are the same one is just a 5 pack and the other is a single. So if you want to use 4 servers you can either get 4 single VM licenses or a 5 VM license and have one left over.  

For more information on ISE licensing check out this document.

https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

[Arne Bier]

The comments so far about licensing are true indeed.  However, as of ISE 2.4 this will no longer be the case and Cisco are turning the licensing model on its head.  2.4 is still in beta but you can join the beta program to get the release notes etc.  Here is the summary so far (it's a beta and Cisco may still change their minds, however it's unlikely to change)

- base licensing will no longer perpetual - they will be term based (1,3,5 years etc.) - existing perpetual licenses that you had from ISE 2.x will expire in April 2021.   Yeah, great, right? :-<

- VM licensing is no longer a one size fits all - there will be a small and medium (and a large to come in later releases)

- TACACS licensing will no longer apply to entire deployment - they will be priced per PSN.

None of these things benefit the customer.  In fairness to Cisco, no official pricing has been released yet but I cannot imagine that 2.4 pricing will make us better off.

[Bram Van den Bosch]

Seems that base licenses are still perpetual in 2.4, but there are some changes to it.

They are now order-able by 'band', for example 100 to 249 endpoints.

My question to this, can they still be stacked?

For example, imagine I deploy ISE for one site which has 200 endpoints.
So I order one L-ISE-BSE-P1 (100 to 249 endpoints)

Later on I want to add a new site to the existing ISE deployment, now I have 300 endpoints total for example.

This would mean I need a L-ISE-BSE-P2 (250 to 499 endpoints), but I already bought a L-ISE-BSE-P1 license?

I'm wondering how Cisco ONE license handels this as well, as you get a fixed amount ISE base/plus with every 'C1' switch you buy.

[pbarman]

Did you ever get a straight reply to your question "This would mean I need a L-ISE-BSE-P2 (250 to 499 endpoints), but I already bought a L-ISE-BSE-P1 license?". I am wondering the same.

[Damien Miller]

They don't stack, each sales order is considered fresh.

[pbarman]

Thank you!

[Torvicvalentin]

Hello Arne Bier, I have a question regarding the ISE solution ... I have a client where I am proposing the ISE solution, with Base, Plus, Apex, licensing, specifically my question is whether the Base license is still perpetual since in the ordering guide of July of this year I still mention it as perpetual, so I would like to know if it is still valid since the client will put the OC

[Jason Kunst]

Base perpetual is available to order, this hasn't changed
https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf