Yeah that's right, I'd created a post about it while ago, I didn't know about the free licenses though.
Cisco Firepower User Agent | Blue Network Security (bluenetsec.com)
I don't believe so as @Ken Stieers also mentioned. Back in the day we used to have another option which was a little software we used to install on Windows to share the user-IP mapping, but that was deprecated and replaced with ISE.
Sorry if I missed this, but why you were not able to get access into CLI?
Check out this link please about how to configure high availability on the ASA firewalls:
Cisco ASA Active/Passive Failover Configuration Example (packetswitch.co.uk)
Yes you can do that with ISE-PIC, please check this video of how to integrate ISE with the FMC, and also this post of mine that might be helpful:
Firepower Management Center (FMC) - User Agent transition to ISE-PIC (youtube.com)
Integrate FMC with IS...
As long as you have "EAP Authentication" usage associated with a separate certificate your authentication and authorization sessions will not be affected. If you are using the guest portal with the same certificate that you will be renewing, then tha...