Licensing updates with Cisco ISE 3.5

[ghalajia]

ISE 3.5 Licensing Consumption Alignment Overview:  

Cisco Identity Services Engine (ISE) 3.5 implemented updates to its licensing consumption logic, aligning actual feature utilization with documented intent and existing licensing guides. This initiative clarifies consumption metrics, rather than altering the core licensing model or tier capabilities (Advantage, Premier, Apex). The primary objective is to rectify prior discrepancies where certain Advantage-tier features did not consume licenses as originally intended. In ISE 3.5 version we intend to address this by ensuring that features like pxGrid, pxGrid Direct, Profiling, and TrustSec reflect their license consumption more accurately.  

Rationale for Alignment: 

These updates are designed to provide clearer visibility into true license consumption, ensure fairness by aligning usage with documented feature utilization, eliminate inconsistent consumption logic across features, and facilitate more accurate license planning and budgeting. 

Enhanced Reporting and Visibility: 

ISE 3.5 introduces new reporting capabilities to support these alignments: 

• Licensing Audit Report: Displays historical daily peak license usage over the last 30 days. 

• Current Active Sessions Report: Offers real-time details on current license consumption, including feature-level breakdowns and MAC addresses. This report can be exported as CSV and scheduled for automated delivery. 

No Enforcement in ISE 3.5:  

There will be NO enforcement in ISE 3.5 for overconsumption of licenses and will trigger non-intrusive "Consumption Alerts" (replacing "Out of Compliance" messages). This will give customers enough time to understand and optimize the license consumption and make them ready for enforcement in future releases.  

Key Alignments in ISE 3.5:  

License consumption is based upon endpoints having an active RADIUS session and any of following criteria:

• Profiling: An Advantage license is now consumed upon endpoint classification by the Profiler, irrespective of its use in an authorization policy. Existing exclusions for guest endpoints and static group assignments remain. 

• pxGrid: License consumption now occurs per active session when session data is shared with pxGrid clients via the session topic (e.g., WebSocket updates, bulk retrieval via REST API). 

• pxGrid Direct: A license is consumed when pxGrid Direct attributes are referenced in an authorization rule and present in the JSON payload, even if the policy does not result in a match. 

• TrustSec: License consumption is tracked and reported based on the actual assignment of a Security Group Tag (SGT) to an endpoint/session, independent of its usage within authorization policies. 

Recommended Internal Actions: 

Organizations should leverage the new ISE 3.5 reports to assess current consumption for pxGrid, pxGrid Direct, Profiling, and TrustSec. Monitoring "Consumption Alerts" and comparing usage against purchased entitlements is crucial for identifying potential gaps and planning any necessary license adjustments prior to future enforcement. Refer to the official Cisco ISE Licensing Guide for comprehensive details. 

Key ISE Upgrade Resources: 

• Refer to the ISE 3.x Licensing Migration Guide for key next steps from migrating your license, software upgrade and potential hardware updates 

• View the Cisco ISE End-User Resource guide 

• Review the latest release notes for ISE 3.5

• Watch the ISE Upgrade recording 

• Check out the Network Access Control Guided Resource 

[craig.beck]

• Profiling: An Advantage license is now consumed upon endpoint classification by the Profiler, irrespective of its use in an authorization policy. Existing exclusions for guest endpoints and static group assignments remain.

Does that mean any profiled endpoint will consume a license indefinitely, or only for the duration of their session? Once the endpoint disconnects, will the license be released?

[nplusplus]

+1 to @craig.beck 's question.

Thank you,

Nathan

[kvamja]

Hi @craig.beck & @nplusplus , the license will be consumed only for the active session and it will be released as soon as the session ends.

[Arne Bier]

If this is implemented and enforced, then it will be time for me to looking at alternative RADIUS products - Clearpass supports profiling and MDM integration as part of the base license. Profiling is not a luxury. Some customers already refuse to pay Plus/Advantage licenses just for profiling and have built their Policy Sets around that. Arista AGNI is also worth looking into.

My advice to ISE users is to migrate your Policy Sets from profiling to alternative solutions, and then disable the Advantage license (if profiling is all you need it for). Spend your efforts to use more 802.1X instead of MAB, and MAC Address prefix Rules, or, creating individual Endpoint Identity Groups that contain the MAC addresses of interest for all the remaining MAB stuff. 

[Justin-Walker]

The justification for this change is wild.  You're saying that because you cant clearly identify for customers which sessions are consuming advantage licenses, you'll just charge for all of the active sessions. 

This change will force customers to turn off profiling completely and complicate existing and new deployments.  Many wired implementations use profiling at a minimum for phone authorization. Converting these endpoints and others to static groups is insane. 

If the goal is to clear up the licensing confusion, include profiling as part of the essential license. Advantage licensing could be reserved for pxGrid and TrustSec consumption. 

[craig.beck]

I agree with the above. As Justin said, include it in the Essentials license or ISE is going to be a hard sell for some customers.

Other vendors will probably have a field day with this.

[kthiruve]

Hi Everyone,

Thank you for the thoughts.
We are gathering feedback from field and partners, reaching out to few of them to understand the use cases.

We will update the licensing guide with more details.

Thanks

[Janne K.]

A bit late to the party, but looking forward to the coming clarifications. As others have mentioned would the changes as described be very disappointing.

[craig.beck]

If an advantage license is consumed for profiling and SGT assignment, will that be a single license or two? I'm assuming single?

[kthiruve]

Hi,

When license change happened few years back from 2.x to 3.x the nested doll model was to enable sellers and partners to use tier based licensing and to move away from feature based licensing using active endpoints as a mechanism to track license counts.

This means that the value of advantage license comes from the Advantage tier that has several features. So to answer your question is, same advantage license can be used by Trustsec, profiling, pxGrid, pxGrid-direct. It will not be double counted.

Hope it clarifies.