03-16-2022 06:05 PM
Hello
As described in the url link below, I would like to integrate ISE and MS AD server for dot1x user authentication.
The number of users is 3,000.
If so, should I purchase 3000 user CALs? Or is it okay to purchase only one device CAL for one ISE server to join?
I don't use the ad server for anything else.
Unfortunately, there is no MS EA contract.
Solved! Go to Solution.
03-16-2022 10:47 PM
Hello @onevf1
There is no need to purchase any Microsoft CAL licenses when integrating ISE to an on-prem Microsoft Windows AD Server.
If you have an AD Domain, then ISE will simply query that as and when it needs to.
The crucial license is on ISE - each successful basic 802.1X authentication (basic means, there was no ISE Profiling involved, nor was there any posture assessment) will consume 1 ISE 2.x Base Licenses. In ISE 3.x it would consume 1 Essentials license.
ISE licenses are based on the CONCURRENT session count (i.e. users who have active session on the switch/wireless/VPN as authenticated by ISE). When those sessions end (timeout, disconnect etc.) then the ISE licenses is freed up again.
03-16-2022 10:47 PM
Hello @onevf1
There is no need to purchase any Microsoft CAL licenses when integrating ISE to an on-prem Microsoft Windows AD Server.
If you have an AD Domain, then ISE will simply query that as and when it needs to.
The crucial license is on ISE - each successful basic 802.1X authentication (basic means, there was no ISE Profiling involved, nor was there any posture assessment) will consume 1 ISE 2.x Base Licenses. In ISE 3.x it would consume 1 Essentials license.
ISE licenses are based on the CONCURRENT session count (i.e. users who have active session on the switch/wireless/VPN as authenticated by ISE). When those sessions end (timeout, disconnect etc.) then the ISE licenses is freed up again.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide