cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

ISE Licensing - Quick Access

39871
Views
62
Helpful
24
Comments

I've had a lot of people ask for this, so I'll post it here.

 

This is for ISE versions prior to 3.0:

***NOTE the Base/Plus/Apex licenses AND the Virtual Machine VMS/VMM/VML Licenses have all been announced End of Life with the End of Sale Date of March 9, 2022***

End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Base, Plus and Apex License PIDs

End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Virtual Machine S/M/L

ISE_Licensing_2.7.png

 

While this graphic covers 3.0 through ISE 3.0 patch 3:

Licensing 3.0.png

 

NOW we need a new graphic for 3.1 (ISE 3.0 Patch 4 and newer will also be covered here):

Licensing 3.1.png

 

With the recent End of Life Announcement for the DNA Premier Licenses, I've removed the information from the ISE 3.0 and 3.1 Licensing slides.  The announcement can be seen here:  

End-of-Sale and End-of-Life Announcement for the Cisco DNA Premier License PIDs for Switching

End-of-Sale and End-of-Life Announcement for the Cisco DNA Premier License PIDs for Wireless

 

I've also made a video detailing the changes that can be found here:

ISE 3.0 Licensing Changes

 

Cisco ISE Licensing Changes from v2.x to v3.1

Cisco ISE Licensing Changes from v3.0 to v3.1

 

The resources used to create the video and slides are:

Cisco ISE Ordering Guide

http://cs.co/ise-ordering-guide

Cisco ISE License Migration Guide

http://cs.co/ise-migration-guide

Cisco ISE Licensing FAQ

http://cs.co/ise-license-faq

 

Cisco ISE 3.0 Admin Guide

http://cs.co/ise-30-admin

Cisco ISE 3.0 Release Notes

http://cs.co/ise-30-rn

 

Cisco ISE 3.1 Admin Guide

http://cs.co/ise-31-admin

Cisco ISE 3.1 Release Notes

http://cs.co/ise-31-rn

 

Comments
Nadav
Rising star
Hi @jmarquez01 , DA licenses are strictly for T+. RADIUS device administration sessions take up a Base license. I should point out that T+ device administration sessions don't take up a Base license. Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_0110.pdf "TACACS+ sessions do not consume a base license, but RADIUS sessions consume a base license"
fbosarreyes
Beginner

ok

jmarquez01
Beginner
Hi Nadav, thank you, now is clear for me.

 Hi Jason,

 

We have lot of deployments where ISE works Primary Admin and Secondary Admin HA way in ISE 2.1 version.

It' has enabled TACACS+ as well.

 

1)So what will happen if we upgrade this HA cluster to 2.4.

 

2) if the we promote secondary ISE to primary node, will tacacs function not work in the new primary node?

 

Regards

Hasitha

 

regards

Hasitha

Marvin Rhoads
VIP Community Legend

@hasitha siriwardhana If you upgrade your pre-2.4 deployment which had the old style Device Administration license, it will remain in effect.

 

In other words, you will be licensed and able to run the Device Admin role on any or all nodes in your ISE deployment without having to purchase any additional licenses.

ffischer
Beginner

Hello,

my understanding from postings above:

An ISE upgrade from <=2.3  to 2.4 automatically converts an installed legacy L-ISE-TACACS=

to a 50 Nodes L-ISE-TACACS-ND=

 

Now, we have some clients who ordered ISE and L-ISE-TACACS= several months ago

They have revceived their PAKs now, but not yet fulfilled or installed anything.

Can we still fulfill the PAK, generate a (legacy) license file

and import this (legacy) dev admin license file to a new (or re-imaged) ISE 2.4 PAN ?

in other words:

Will freshly installed ISE 2.4 accept the legacy license file and we end up with a 50 Node DevAdmin ?

 

If not: how do we fix this ?

 

BR

Frank

Nadav
Rising star

To enjoy being "grandfathered in", you'll need to upgrade from an ISE version older than 2.4.

 

You can't install a single DA license on ISE 2.4 and have it become 50 DA licenses, regardless of when it was bought.

kegagnon
Cisco Employee

Nadav,

Do you have a screen capture of an ISE 2.4 fresh install with the L-ISE-TACACS= license key installed? We have heard people tell us something similar to what you suggest but have never gotten a screen capture from anyone showing us the problem.

Thanks in Advance, Kevin

ffischer
Beginner

Hi,

found solution in this thread:

> Cisco ISE 2.4 with L-ISE-TACACS= SKU

> yes you can apply it directly to a 2.4 deployment. 
> did it just the other day.

BR

Frank

Create
Recognize Your Peers
Content for Community-Ad