Number of license and revoke/issue certificates by ISE

taasai · ‎03-12-2020

Hi experts,
Please help me develop my understanding of the Internal CA feature and the required license.

I have a customer who has deployed ISE with 1000 Base license, for example. Now they want to utilize this for their new VPN infrastructure. The number of VPN users will be 500. This use case is exactly like the described scenario on this guide.

"Cisco Identity Services Engine Administrator Guide, Release 2.6 Chapter: Manage Certificates Cisco ISE CA Service ISE CA Issues Certificates to ASA VPN Users."

In my understanding, the required license is 500 Plus license(please correct me if I'm wrong). And my questions are,

1. Is the number of certificates the ISE can issue limited by the number of licenses installed?

2. Also, are these certificates that have been issued by ISE able to revoke regardless of the number of licenses installed?

The customer is worrying if there might be a situation that the ISE can't revoke certificates due to the insufficient license.

Regards,

Tatsuya

Cristian Matei · ‎03-12-2020

Hi,

Cisco ISE Licensing is based on concurrent endpoint active sessions. So there will be no limitation on how many certificates you can issue or choose to revoke.

Regards,

Cristian Matei.