ISE | Posture Assessment license

[hanguye3]

Hi team,

I have an question on the ISE license and need advise on that: if our customer wants to use the Posture Compliance feature on their PCs, do we need both the AnyConnect component + Apex license or only need the Apex license?

I think the answer is we need both Apex + AnyConnect license but I do not see the AnyConnect license count on the PAN GUI.

Highly appreciate for any quick response. thanks in advance.

Br,

hainm

[Francesco Molino · Accepted solution]

Hi

See on the official licensing guide (table 3), you're required to get anyconnect apex licenses in addition of ISE Apex for posture.
https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

Text says:
Please note that Cisco AnyConnect® Apex user licenses are required in addition to Cisco ISE Apex licenses when making use of Cisco AnyConnect posture services across wired, wireless, and VPN

[Jason Kunst]

@Francesco Molino is correct.

Anyconnect licenses aren’t install on ise and will not show on ise. If you have an ASA I believe they need to be installed there if using for VPN but you would need to inquire with Anyconnect expert 

[Francesco Molino]

And just to add what @jason said, Anyconnect licenses aren’t checked at any steps of the process. It’s based on trust. Even if you don’t have any ASA or if you don’t buy any anyconnect licenses it will work as soon as you have APEX licenses on ISE to enable posture feature.
Few customers make this mistake by only purchasing ISE Apex licenses.