will ISE stop working in Out of Compliance mode?

[jpoh]

Hi Team,

sorry to bother everyone here. My customer has register their ISE to SA-infra.my.com and everything is working fine. They are in process to consolidate all SA into single SA-my.com. I have log a case for smart ops team to move the license in SA-infra.my.com to SA-my.com. Smart ops team told me once he move the license, since ISE is still pointing to SA-infra.my.com via satellite server, ISE will stop working. Is this true? 

I thought there is a 30 or 60 days for OOC stage? 

The steps given is to de-register ISE from SA-infra.my.com, and register ISE back to SA-my.com. During this period, will ISE stop working at all? 

Appreciate for your advise

Regards &

Have a nice day

[kthiruve · Accepted solution]

Please check the ordering guide on what is out of compliance and its impact.

Also Cisco employee's are recommended to post questions from in internal forums.

Here is the link.

Ask ISE

-Krishnan

[Arne Bier · Accepted solution]

@jpoh  - if your ISE is currently using Smart Licensing (or 'SA' as you call it - Smart Account?) and then you decide to de-register it, it means that ISE will revert back to the eval mode of Smart Licensing.  If your system has been running some time then your eval would have expired. But that doesn't matter. You can run in eval for a while - check the Licensing Guide from the previous post.  ISE won't collapse and die if you don't give it the required licensing immediately.  Just make sure you can register it to Smart Licensing account at your earliest convenience.

By the way - Smart Licensing Satellite server doesn't work with ISE.  It's not supported.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_0110.html#id_24694

With ISE you can opt for the Transport Gateway instead. It's an OVA appliance that you have to download from software.cisco.com - I guess it's the pre-cursor to the CSSM (Cisco Smart Software Manager - aka "Satellite Server") - I have never used it.  Fortunately, my customers have gone direct to Cisco backend over https.