ISE Virtual Appliance vs Physical Appliance (difference in licensing)

[tslobodi@cisco.com]

I am helping my customer navigate through what is needed to migrate off of their ISE Physical Appliances and onto Virtual Appliances.

TAC/Licensing stated that the customer needs to purchase two R-ISE-VMS-K9 virtual machine licenses because “there are some licenses needed which the customer does not have when they purchased their physical appliances”.

Customer wants to know what is included with the Virtual Licenses that is not included with their Physical Appliances.

Thank you.

[Damien Miller]

The only difference when we are scoping an ISE build on physical vs virtual is the ISE VM licenses. The R-ISE-VMS-K9= will cover a 3515 or 3615 template VM.

Base, plus, and apex licensing doesn't change between physical and virtual.

TACACS is the same between physical and virtual, but keep it did change about a year ago. If the customer ordered the original deployment wide TACACS licensing, then they have entitlement to 50 nodes. If they need to purchase new TACACS licensing, then this will be per node the serviceis enabled on. This is not specific to physical or virtual though.

And if by chance the customer had ordered some of the legacy ISE VM licenses, those get converted to new R-ISE-VMM-K9 medium VM licenses. It sounds like they do not have any of these though, and likely wouldn't if they ordered physical SNS appliances to start.

[tslobodi@cisco.com]

Thank you Damien.  When the customer requested to rehost their licenses on their virtual servers, TAC/Licensing said that they need to purchase the VM licenses.  Is there a reason why they have to purchase the VM licenses versus simply downloading and installing the OVAs and then moving their ISE licenses over?  If it's a simple answer of "customer needs to buy the new platform (aka VM) as it is not a free offer (similar to having to purchase a physical appliance) then I understand.  Customer assumed that the VM server(s) would be free and they simply needed to rehost their licenses (aka base, plus, apex).

[Damien Miller · Accepted solution]

Anyone can download the VM's and deploy them, but they only have 90 days of evaluation licensing. Any VM deployment will require ISE VM licenses to be compliant even if they are not enforced today. If the customer owns no ISE VM licenses, then they have to purchase them, there is nothing to rehost or migrate at that point from a platform/node perspective.

The endpoint licensing (base/plus/apex), and TACACS licensing, are portable and can be rehosted.

Physical SNS appliances do not provide you with any VM license allocation.