Hi,   You can use log filters with username so that it does not show up in logs.   Go to ISE UI > Administration > Logging > Collection filter and enable this for the specific username you want to filter.   -Krishnan ... View more

Thank you Ben.   Here is the ISE ordering guide that will provide additional information on how licenses work end of section 4, section 5 and section 6( for other license related information).   https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf   -Krishnan   ... View more

Thank you Damien for your elaborate response. Here is a quick pointer to the ISE upgrade best practices guide, that discusses upgrade path, how you have to migrate, best practices etc.   https://community.cisco.com/t5/security-documents/ise-upgrades-best-practices/ta-p/3656934   -Krishnan ... View more

Ken,   This goes to the fundamentals of EAP-TLS, when you are validating a machine or user, the supplicant presents client certificate that the server verifies it and viceversa. A machine certificate is unique per endpoint and has to work with the environment. There are PKI standards that govern this and CA adheres to this standards and provides an easy way to manage certificates.   The enrollment process can be manual or via GPO's or web enrollment. Manual is tedious if you have a lot of endpoints. Anyway you need a CA to provide you a certificate that is the bottomline. Hope it is clear.   Here is a configuration guide for EAP-TLS using wireless. https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213543-configure-eap-tls-flow-with-ise.html   Thanks Krishnan   ... View more

Please use the upgrade best practices doc that answers questions about the choices the upgrade path etc. https://community.cisco.com/t5/security-documents/ise-upgrades-best-practices/ta-p/3656934 Yes, that is the email ID to reach out for assistance.   -Krishnan ... View more