MAB DEVICES ARE CONSUMING PLUS LICENSES

[lajan jaleel]

Dear Team,

We have ISE Servers with Base license. We are using the ISE services only for Dot1x authentication for users and MAB authentication for Cisco IP Phone and Printers in the network. We are assigning Dynamic vlans for all devices. As i know MAB will only consume BASE license but right now MAB devices are consuming plus license from Cisco ISE.

We are running ISE ver 2.0.0.306.

Kindly advise if someone had faced this issue before.

Thanks & Regards,

LAJAN JALEEL

[Francesco Molino]

Hi

You can consume PLUS licenses even if you are using MAB in the case you are using profiling groups under rules.

Could you drop an output of your rules and the groups you are using (the details of the group in order to see if there are child of a profiled group).

If you create your own group (Printers for example), it will not use any PLUS licenses.

Thanks

PS: Please don't forget to rate and mark as correct answer if this solved your issue.

[lajan jaleel]

Dear Supportlan,

Thanks for your reply.

I had cross checked the configuration. we configured new identity group for all the endpoint group. We are not using any profiled endpoint groups. please find the attachment.

Also i had noticed that in home page 5 devices are showing as profiled. i believe that is the count showing as plus license consumption. Please find the attached screenshots and advise.

Thanks & Regards,

LAJAN JALEEL

[Francesco Molino · Accepted solution]

Ok.

If you see 5 devices profiled, ISE don't care on license point of view. There aren't counting in license PLUS usage.

On your screenshot, you are using a Printer group that's a child of Registereddevices. As I think you are using this group on ISE rules, all authentication/authorization passing through that rule is counting as PLUS license.

You need to create another group with no parent group and you'll never see any PLUS license counters.

Hope this is clear.

PS: Please don't forget to rate and mark as correct answer if this solved your issue

[lajan jaleel]

Dear Supportlan,

Thanks for your reply.

I will try to to create new groups and check the license usage. I will update once i complete the configuration.

Thanks & Regards,

LAJAN JALEEL

[Francesco Molino]

ok but don't forget to create a completely new group without any parent group associated.

Thanks

PS: Please don't forget to rate and mark as correct answer if this solved your issue

[lajan jaleel]

Dear Supportlan,

Sorry for the delay in reply.

We had created new Identity Group and moved all the mac addresses from registered device to the new group. After that the licensing issue has been resolved.

Thanks for you support.

Thanks & Regards,

LAJAN JALEEL

[Francesco Molino]

You're very welcome