Re-Hosting ISE Licenses

[siddhesh.parab@orange.com1]

Hello Team,

we have below setup of ISE nodes on VM.we are planning to upgrade ISE nodes on v2.6 using Re-image method

Region 1 (DC)---> 6 ISE nodes (2 ADM/2MnT/2PSN)

Region 2--------> 2 PSN 

Region 3--------> 2 PSN 

Region 4--------> 2 PSN 

Our plan is as below.

1. sec ADM

2. sec MnT

3. PSN (one by one region wise)

4. pri. MnT

5. pri. ADM

Question is related to when we should re-host the licenses :- (we have traditional licenses)

1. our plan is , post upgarding (Re-imaging) sec adm & sec MnT,  we will re-host licenses to new deployment however by doing so will my traffic of old setup hamper ?? (i.e. if i re-host licenses at this stage will my users still be able to use licenses in old setup)

2. Need your suggestion.. At which stage should i re-host the licenses ??

Thanks in advanced.

[marce1000 · Accepted solution]

 https://community.cisco.com/t5/security-documents/how-do-i-rehost-my-existing-ise-license-s-onto-a-new-or/ta-p/3632248

 M,

[Damien Miller · Accepted solution]

My suggestion would be to rehost them now, by switching the existing deployment to smart licensing. Then when you go to upgrade it's easy to just register the deployment to the smart licensing server and be done.

[Arne Bier]

I'll second what @Damien Miller said about Smart Licensing. No more licensing pain. Better sleep at night etc. :-)

Granted, if the customer doesn't allow internet access from the ISE PAN then it could throw a spanner in the works. But even the most paranoid of organisations can implement this using the https proxy function in ISE to ensure that Cisco Call Home / Smart Licensing goes via the authenticated proxy. Failing that, ask your web proxy guys (if you use proxy ...) to add the IP addresses of the PAN nodes into an allow list, to allow them to access tools.cisco.com (IIRC)