Smart licensing issue

[sujanyakj]

We upgrade the ise box from 2.4 to 2.7 version, and we found one error like "secondary admin node is added to the deployment, please register smart licensing"

We tried update, but it didnt fixed. As a lat step we have de-registered the smart license and tried to register it with new token. But we are failing here. Tried multipls time but same issue.kindly suggest on this

[Arne Bier]

I sometimes have to de-register Smart from the ISE UI, wait 5 minutes. Then I log into the Smart Licensing account, search for the ISE node and then I delete it. Then I re-register from ISE again. Of course, you must have the Secondary Admin Node in full sync with the Primary Admin node before doing all this.

Is ISE talking directly to Smart Licensing (on the internet) or do you go via a CSSM satellite appliance.

[sujanyakj]

Hi Arne,

When I tried with new token i was able to register to smart licensing and both my VM and TACACs license is showing in compliance except base license which is showing release entitlement (multiple devices which uses radius protocol we have authenticated against ISE and accounting is enabled) and last authorization column ia blank.please suggest here 

 

[MaErre21325]

Hello @arny 

i've the same issue although Ise is correctly able to contact Smart Licensing via internet

[Arne Bier]

Hi @MaErre21325 

What exactly is the problem here?  Release Entitlement is not an issue. It means that ISE is not using that license. If you want, you can disable it (e.g. if you don't have any Advantage or Premier)

[MaErre21325]

Hi @Arne Bier ,

licenses are ok, i have the "secondary admin node is added to the deployment, please register smart licensing" warning although is correctly registered via smart account

[Arne Bier]

oh ok - if the Secondary Admin was registered AFTER you already had Smart Licensing working (on a single PAN) then I think ISE gets confused ... and sadly, I recommend you de-register and re-register again. I always leave the Smart Registration at the end of the ISE build - I wait until both PANs are in the same deployment before I register Smart.  

The name is "Smart" licensing but I often wonder why they call it that. It leaves much to be desired.

[MaErre21325]

yeah, smart license is an euphemism.
de-register and re-register again will impact the service?

[Arne Bier]

Nope. You can deregister without impact. It will put you back in eval mode.

[Arne Bier]

As you already hinted, your NAD devices must send RADIUS Accounting (Start/Stop at least) to ISE to make the licensing more real-time. 

The Last AuthZ column in Smart Licensing means that ISE has not communicated with the Cisco backend.

IS your ISE configured to talk https directly with the internet?

Have you tried to refresh the Authorization on the ISE Licensing page?

If things don't look normal then best to get Cisco TAC involved

[sujanyakj]

Hi Arne,

Yes, because the count was varying before upgrade. And ISE contact internet via direct https. 

Only last authorization column for base license is not refreshing.