License count and active session do not match

[dgaikwad]

Setup:
Version 2.4 patch 5.

The active sessions are at a count of 47, but the base license consumption is peaked at 650 and  plus at 100.
Any idea why such a dependency is visible?

[ahollifield]

This is a REALLY old patch of ISE 2.4. I would install the latest patch (14) before doing any additional troubleshooting.  Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-743964.html

[dgaikwad]

Thank you! Getting it patched to the latest one is being planned for upcoming month.

[thomas]

You currently have 47 active sessions. This probably changes quite dynamically throughout the day as users and their devices come and go.

You had a peak of 650 and 100.

I don't understand the problem.

[dgaikwad]

If the number of active sessions on the dashboard at 47, while the license consumption is showing 650...
And the amazing thing is that we do not even have that many combined all offices!

[hslai]

The active endpoints count at ISE dashboard is based on the ISE context visibility while the licensing consumption is based on the ISE session directory. ISE session directory would keep the sessions as active when the accounting STOP requests do not carry the same class attribute.

[dgaikwad]

If that is the case then, is there any way that the license consumption is reflected by the number of actual active endpoints?
Or how to flush the session directory?

[hslai]

When a client endpoint gets no further updates after 5 days, ISE will purge it from the active session. Else, you may use ISE API > Using API calls for Session Management > Stale Sessions to manage the sessions.