ISE MAB authentication license usage

[west33637]

Hello all. If I need ISE to authenticate wireless user MAC addresses (MAC Address bypass) in order to facilitate central web authentication - does every concurrent device MAC address that accesses my guest wireless SSID and gets forwarded to ISE for authentication use up a license?

I have many users with smart phones and tablets that have the guest wireless SSID profile already saved and automatically connect to the guest SSID when in range. Most of these users do not go on to log in via central web authentication, but their MAC addresses get forwarded to ISE for authentication. Does ISE use up a license per MAC address?

Thanks,

[Saurav Lodh]

Yes, license will be consumed

[ipagliani]

Ciao,

I'd like add a bit in a public scenario (hospital, university..): I've 5000 users per day correctly authenticated and 12000 consumed by MAB !

It's impossible use the CWA. Do you agree with me ?

Is the LWA the only way to fix it ? ( my customer doesn't wan't buy 7000 o more licenses)

Thanks

[nspasov]

Ciao, 

Yes, LWA would do the trick as long as the AAA is kept local to the WLC. If you set the LWA to also be processed through ISE then you will still consume the license :)

Thank you for rating helpful posts!

[nspasov]

Hello-

Please take a look at the following link:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/installation_guide/ise_ig/ise_app_d_man_license.html

So, in your situation, a license will be consumed even though the user never authenticates. This is because a license is consumed as soon as a session hits a rule in your AAA ISE policies. However, you can from the document that as soon as the session times out the endpoint would free the license. If for some reason an "accounting-stop" message is not received then after 5 days of inactivity the system will automatically free the license. 

Hope this helps!

Thank you for rating helpful posts!