ISE Licensing - Quick Access

[Charlie Moreton]

I've had a lot of people ask for this, so I'll post it here.

I've created a Cisco ISE 2.x to 3.x License Migration Calculator, but I could not find a way to host it on Cisco sites and show the calculations as they happened.  For that reason, I put it on my external site, isedemolab.com.

This is for ISE versions prior to 3.0:

***NOTE the Base/Plus/Apex licenses AND the Virtual Machine VMS/VMM/VML Licenses have all reached End of Sale ***

End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Base, Plus and Apex License PIDs

End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Virtual Machine S/M/L

While this graphic covers 3.0 through ISE 3.0 patch 3:

NOW we need a new graphic for 3.1 (ISE 3.0 Patch 4 and newer will also be covered here):

With the recent End of Life Announcement for the DNA Premier Licenses, I've removed the information from the ISE 3.0 and 3.1 Licensing slides.  The announcement can be seen here:  

End-of-Sale and End-of-Life Announcement for the Cisco DNA Premier License PIDs for Switching

End-of-Sale and End-of-Life Announcement for the Cisco DNA Premier License PIDs for Wireless

I've also made a video detailing the changes that can be found here:

ISE 3.0 Licensing Changes

Cisco ISE Licensing Changes from v2.x to v3.1

Cisco ISE Licensing Changes from v3.0 to v3.1

The resources used to create the video and slides are:

Cisco ISE Ordering Guide

http://cs.co/ise-ordering-guide

Cisco ISE License Migration Guide

http://cs.co/ise-migration-guide

Cisco ISE Licensing FAQ

http://cs.co/ise-license-faq

Cisco ISE 3.0 Admin Guide

http://cs.co/ise-30-admin

Cisco ISE 3.0 Release Notes

http://cs.co/ise-30-rn

Cisco ISE 3.1 Admin Guide

http://cs.co/ise-31-admin

Cisco ISE 3.1 Release Notes

http://cs.co/ise-31-rn

[Nadav]

Hi @jmarquez01 , DA licenses are strictly for T+. RADIUS device administration sessions take up a Base license. I should point out that T+ device administration sessions don't take up a Base license. Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_0110.pdf "TACACS+ sessions do not consume a base license, but RADIUS sessions consume a base license"

[fbosarreyes]

ok

[jmarquez01]

Hi Nadav, thank you, now is clear for me.

[hasitha siriwardhana]

 Hi Jason,

We have lot of deployments where ISE works Primary Admin and Secondary Admin HA way in ISE 2.1 version.

It' has enabled TACACS+ as well.

1)So what will happen if we upgrade this HA cluster to 2.4.

2) if the we promote secondary ISE to primary node, will tacacs function not work in the new primary node?

Regards

Hasitha

regards

Hasitha

[Marvin Rhoads]

@hasitha siriwardhana If you upgrade your pre-2.4 deployment which had the old style Device Administration license, it will remain in effect.

In other words, you will be licensed and able to run the Device Admin role on any or all nodes in your ISE deployment without having to purchase any additional licenses.

[ffischer]

Hello,

my understanding from postings above:

An ISE upgrade from <=2.3  to 2.4 automatically converts an installed legacy L-ISE-TACACS=

to a 50 Nodes L-ISE-TACACS-ND=

Now, we have some clients who ordered ISE and L-ISE-TACACS= several months ago

They have revceived their PAKs now, but not yet fulfilled or installed anything.

Can we still fulfill the PAK, generate a (legacy) license file

and import this (legacy) dev admin license file to a new (or re-imaged) ISE 2.4 PAN ?

in other words:

Will freshly installed ISE 2.4 accept the legacy license file and we end up with a 50 Node DevAdmin ?

If not: how do we fix this ?

BR

Frank

[Nadav]

To enjoy being "grandfathered in", you'll need to upgrade from an ISE version older than 2.4.

You can't install a single DA license on ISE 2.4 and have it become 50 DA licenses, regardless of when it was bought.

[kegagnon]

Nadav,

Do you have a screen capture of an ISE 2.4 fresh install with the L-ISE-TACACS= license key installed? We have heard people tell us something similar to what you suggest but have never gotten a screen capture from anyone showing us the problem.

Thanks in Advance, Kevin

[ffischer]

Hi,

found solution in this thread:

> Cisco ISE 2.4 with L-ISE-TACACS= SKU

> yes you can apply it directly to a 2.4 deployment. 
> did it just the other day.

BR

Frank

[ffischer]

> yes you can apply it directly to a 2.4 deployment. 
> did it just the other day.