Guest

Cisco Identity Services Engine

Cisco Identity Services Engine Ordering Guide

  • Viewing Options

  • PDF (374.6 KB)
  • Feedback

Traditional corporate network boundaries and siloed services are a thing of the past. Today’s networks must accommodate an ever-growing array of consumer IT devices while providing user-centric policy and enabling global collaboration. The Cisco TrustSec® architecture addresses this shift by using identity-based policies to give users and devices access to the network without sacrificing control. The Cisco® Identity Services Engine (ISE) works in conjunction with the Cisco TrustSec technology to automate and simplify access control and security compliance for wired, wireless, and VPN connectivity. Customers can use a range of next-generation physical or virtual appliances and associated licenses for a Cisco ISE deployment. This guide provides the information needed to order the appliances and licenses for an ISE deployment.

Cisco ISE Ordering Steps

1. Estimate the number of concurrent endpoints in the network. Concurrent endpoints is the number of endpoints with active network sessions that have authenticated through ISE. For example, 500 iPads and 500 laptops with active network sessions equals 1,000 concurrent endpoints.

2. Estimate the number of appliances (physical or virtual) needed to support number of concurrent endpoints in the network.

Please consult a network professional that has been Cisco ISE-trained and certified to design and estimate the number of ISE appliances needed.

3. Select the appropriate type of appliance for the deployment.

4. Select the appropriate level of support needed for the appliances in your deployment.

5. Select the appropriate type of license suitable for your deployment.

6. Select the appropriate level of services available from Cisco Advanced Services or a Certified Partner for the design, deployment, and sustaining services of the deployment.

Step 1: Estimate the Number of Concurrent Endpoints in the Network

The number of concurrent endpoints is the number of endpoints with active network sessions that have been authenticated through Cisco ISE. For example, 500 tablets and 500 laptops with active network sessions equals 1,000 concurrent endpoints. One approach to estimating the total number of concurrent endpoints would be to take into account:

Number of employees in the organization

Average number of devices per employee (desktop, laptop, smartphone, desk IP phone, and so on)

Number of switch ports currently in the organization

Number of access points deployed in the organization

Average number of devices per access point

Dynamic IP address range being used

Average number of guests expected to join the network

Number of nonuser devices such as IP cameras, printers, IP-enabled projectors, and so forth

Those components as well as others can help determine the total number of concurrent endpoints.

Step 2: Estimate the Number of Appliances or Servers Needed for the Deployment

The total number of appliances or servers needed in a deployment is determined by a number of factors, including but not limited to the total number of concurrent endpoints, use cases, high-availability requirements, andlocations.

Please consult a network professional that has been trained and certified to design and estimate the number of Cisco ISE appliances needed.

For Cisco presales support, please consult the help desk. The help desk is open 24 hours Monday through Friday, in all countries.

Phone: 408 902-4872

Email: sac-support@cisco.com

Live chat: http://tinyurl.com/sacise

Step 3: Select the Appropriate Type of Appliance or Server

A Cisco ISE deployment can consist of one or more appliances or servers. These appliances or servers can be centrally located, distributed, or both. All Cisco ISE appliances and servers include a 90-day evaluation license, which enables all services for 100 endpoints. Table 1 outlines the available appliance and server options.

The appliances with part numbers ISE-3315-K9 and ISE-3355-K9 are no longer orderable and are shown for reference only. The appliances with part numbers SNS-3415-K9 and SNS-3495 are the suggested replacement products.

Table 1. Cisco ISE Appliances and Servers

Cisco ISE Appliances

Option 1: Cisco ISE Appliances and Servers

Part Number

Endpoints Supported

Cisco Secure Network Server 3415

SNS-3415-K9

5,000

Cisco Secure Network Server 3495

SNS-3495-K9

20,000

Cisco ISE 3315 Appliance

(no longer available)

ISE-3315-K9

3,000

Cisco ISE 3355 Appliance

(no longer available)

ISE-3355-K9

5,000

Cisco Identity Services Engine 3395 Appliance

ISE-3395-K9

10,000

Option 2: Cisco ISE Virtual Appliance on VMware ESX or ESXi 4.x and 5.x Hypervisor

Paper Entitlement Delivery

eDelivery Entitlement

Cisco ISE Virtual Appliance

ISE-VM-K9=

R-ISE-VM-K9=

Bundle of 5 Cisco ISE Virtual Appliances

ISE-5VM-K9=

R-ISE-5VM-K9=

Bundle of 10 Cisco ISE Virtual Appliances

ISE-10VM-K9=

R-ISE-10VM-K9=

Notes: The Cisco Secure Network Server is a multipurpose server and can support Cisco ISE, Cisco Secure Access Control Server, and Cisco Network Access Control applications. One application can be selected as a software option to be installed on the server. To order Cisco ISE and the Cisco Secure Network Server, order the appropriate product part number (SNS-3415-K9 or SNS-3495-K9) and then select Cisco ISE as the software option. Please consult a Cisco certified design engineer regarding the specific models needed for your deployment prior to ordering any of the Cisco Secure Network Servers or Cisco ISE 3300 Series Appliances.

To achieve the same level of performance and scalability as provided by Cisco ISE hardware appliances, Cisco ISE virtual appliances must be installed on servers with the same configurations as the Cisco ISE hardware appliances. Consult the Cisco Identity Services Engine Installation Guide for more information.

Step 4: Select the Appropriate Level of Support

Four types of Cisco SMARTnet support services are available for Cisco ISE customers using physical appliances:

8x5xNBD: Next business day

8x5x4: Standard 4-hour service

24x7x4: Premium 4-hour service

24x7x2: Premium 2-hour service

Cisco SMARTnet support services include global access to the Cisco Technical Assistance Center (TAC), advance hardware replacement, and Cisco ISE software updates and all minor and major upgrades. Access to the extensive Cisco.com knowledge base and tools is also included. For more information about Cisco SMARTnet service offerings, please visit http://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2978/serv_group_home.html.

For Cisco ISE customers using virtual appliances, Cisco offers Software Application Support plus Upgrades (SASU). Cisco SASU services include global access to Cisco TAC and ISE software updates and all minor and major upgrades. Access to the extensive Cisco.com knowledge base and tools is also included. For more information about Cisco SASU offerings, please visit http://www.cisco.com/en/US/products/svcs/ps3034/ps2827/ps2993/serv_group_home.html.

Table 2 lists the product part numbers of the four service options available for Cisco ISE physical appliances. Table3 lists the service options for the Cisco Secured Network Servers. Table 4 lists the product part numbers for the available service options for Cisco ISE virtual appliances. All support licenses are in effect for one year from the purchase date.

Table 2. Cisco ISE Physical Appliance Support

Cisco SMARTnet Service Option Part Number

Appliance Part Number

8x5xNBD

8x5x4

24x7x4

24x7x2

ISE-3315-K9

(no longer available)

CON-SNT-ISE3315

CON-SNTE- ISE3315

CON-SNTP- ISE3315

CON-S2P- ISE3315

ISE-3355-K9

(no longer available)

CON-SNT- ISE3355

CON-SNTE- ISE3355

CON-SNTP- ISE3355

CON-S2P- ISE3355

ISE-3395-K9

CON-SNT- ISE3395

CON-SNTE- ISE3395

CON-SNTP- ISE3395

CON-S2P- ISE3395

Table 3. Cisco Secure Network Server Support

Server Part Number

SMARTnet Part Number

Description

SNS-3415-K9

CON-SNT-SNS-3415

Cisco SMARTnet support for SNS-3415-K9 - 8x5 Next Business Day

SNS-3495-K9

CON-SNT-SNS-3495

Cisco SMARTnet support for SNS-3495-K9 - 8x5 Next Business Day

Table 4. Cisco ISE Virtual Appliance Support

Virtual Appliance Part Number

Cisco SASU Part Number

ISE-VM-K9= or R-ISE-VM-K9=

CON-SAU- ISEVM

ISE-5VM-K9= or R-ISE-5VM-K9=

CON-SAU- ISE5VM

ISE-10VM-K9= or R-ISE-10VM-K9=

CON-SAU- ISE10VM

Step 5: Select the Appropriate Type of License

Cisco ISE license options allow customers to choose between function-based licensing or deployment-based licensing.

Function-Based Licensing

The Base license is intended for organizations that want to authenticate and authorize users and devices on their networks (wired, wireless, and VPN). Base licenses include support for authentication, authorization, and accounting (AAA) services, guest lifecycle management, compliance reporting, and end-to-end monitoring and troubleshooting. The Base license is a perpetual license.

The Advanced license expands on the Base license and enables organizations to make more advanced policy decisions based on user and device compliance. Advanced license features include device onboarding and provisioning, device profiling, posture services, mobile device management (MDM) integration capabilities, and Cisco Security Group Access enforcement capabilities across the entire network (wired, wireless, and VPN). The Advanced license is a subscription-term-based license, with a choice of 1-, 3-, or 5‑year term subscriptions.

Note: Do not order and install Cisco ISE Base and Advanced licenses on deployments using Cisco ISE Wireless and Wireless Upgrade Licenses.

Deployment-Based Licensing

The Wireless license is intended for organizations that want to start a Cisco ISE deployment for wireless endpoints only. The Wireless license includes both Base and Advanced license features. The Wireless license is a subscription-term-based license with a choice of 1-, 3-, or 5‑year term subscriptions. The Wireless Upgrade license is intended for customers who have deployed the Cisco ISE for wireless endpoints only and want to expand their deployment to wired and VPN endpoints. The Wireless Upgrade license installs on top of the Wireless license and is a term license whose term coincides with the preexisting Wireless license.

Notes: A Cisco ISE Wireless Upgrade license does not increase the number of endpoints supported in a deployment. The number of supported endpoints is determined by the quantity specified in the Cisco ISE Wireless license. For software version 1.2, the Wireless Upgrade quantity can be less than the number of installed Wireless licenses. For software version 1.1.x, the Wireless Upgrade quantity should be the same as the installed Wireless license quantity.

The type of license needed is determined by the deployment functions, the specific use cases, the number of concurrent endpoints on the network, and, in the case of the Advanced or Wireless licenses, the term duration. Cisco ISE licenses are specific to a deployment and not to individual appliances in the deployment. Cisco ISE licenses can be ordered at the same time as, or separately from, an appliance order. Please note that the Advanced licenses can be added only on top of Base licenses, and that the number of Advanced licenses can never exceed the number of Base licenses. Similarly, the Wireless Upgrade license can be installed only on top of a Wireless license. The Wireless Upgrade license count has to match the Wireless license count.

Table 5 lists the various Cisco ISE licenses.

Product Activation Key (PAK) File

Licenses for Cisco ISE are delivered via email to the assigned recipient. After a license sales order is processed, the recipient will be emailed PAKs for the licenses. For term licenses, the term begins when the PAK has been emailed. The PAK file contains instructions and a URL for registration. After PAK registration the license file will be emailed to the recipient.

Table 5. Cisco ISE License Packages

License Type

Features Supported

Deployment Type Supported

License Prerequisite

License Term(s)

Base license

AAA

Guest provisioning

Link encryption policies

Wired

Wireless

VPN

-

Perpetual

Advanced license

Device onboarding/provisioning

Device profiling and feed service

Host posture

Cisco Security Group Access

Integrated vendor MDM support

Wired

Wireless

VPN

Base license

1-, 3-. and 5-year

Wireless license

Device onboarding/provisioning

AAA

Guest provisioning

Link encryption policies

Device profiling and feed service

Host posture

Cisco Security Group Access

Integrated vendor MDM support

Wireless

-

1-, 3-, and 5-year

Wireless Upgrade license

Device onboarding/provisioning

Authentication and authorization

Guest provisioning

Link encryption policies

Device profiling

Host posture

Cisco Security Group Access

Wired

Wireless

VPN

Wireless license

1-, 3-, and 5-year

Table 6 lists the product part numbers associated with previous Cisco ISE license options.

Table 6. Cisco ISE License Packages: Previous Part Numbers

License Tiers (T)

Number of Endpoints Supported

Base License

Advanced 3‑Year License

Advanced 5‑Year License

Wireless 3‑Year License

Wireless 5‑Year License

Wireless Upgrade 3‑Year License

Wireless Upgrade 5‑Year License

100

100

L-ISE-BSE-100=

L-ISE-ADV3Y-100=

L-ISE-ADV5Y-100=

L-ISE-AD3Y-W-100=

L-ISE-AD5Y-W-100=

L-ISE-W-3UPG-100=

L-ISE-W-UPG-100=

250

250

L-ISE-BSE-250-

L-ISE-ADV3Y-250=

L-ISE-ADV5Y-250=

L-ISE-AD3Y-W-250=

L-ISE-AD5Y-W-250=

L-ISE-W-3UPG-250=

L-ISE-W-UPG-250=

500

500

L-ISE-BSE-500=

L-ISE-ADV3Y-500=

L-ISE-ADV5Y-500=

L-ISE-AD3Y-W-500=

L-ISE-AD5Y-W-500=

L-ISE-W-3UPG-500=

L-ISE-W-UPG-500=

1,000

1,000

L-ISE-BSE-1K=

L-ISE-ADV3Y-1K=

L-ISE-ADV5Y-1K=

L-ISE-AD3Y-W-1K=

L-ISE-AD5Y-W-1K=

L-ISE-W-3UPG-1K=

L-ISE-W-UPG-1K=

1,500

1,500

L-ISE-BSE-1500=

L-ISE-ADV3Y-1500=

L-ISE-ADV5Y-1500=

L-ISE-AD3Y-W-1500=

L-ISE-AD5Y-W-1500=

L-ISE-W-3UPG-1500=

L-ISE-W-UPG-1500=

2,500

2,500

L-ISE-BSE-2500=

L-ISE-ADV3Y-2500=

L-ISE-ADV5Y-2500=

L-ISE-AD3Y-W-2500=

L-ISE-AD5Y-W-2500=

L-ISE-W-3UPG-2500=

L-ISE-W-UPG-2500=

3,500

3,500

L-ISE-BSE-3500=

L-ISE-ADV3Y-3500=

L-ISE-ADV5Y-3500=

L-ISE-AD3Y-W-3500=

L-ISE-AD5Y-W-3500=

L-ISE-W-3UPG-3500=

L-ISE-W-UPG-3500=

5,000

5,000

L-ISE-BSE-5K=

L-ISE-ADV3Y-5K=

L-ISE-ADV5Y-5K=

L-ISE-AD3Y-W-5K=

L-ISE-AD5Y-W-5K=

L-ISE-W-3UPG-5K=

L-ISE-W-UPG-5K=

10,000

10,000

L-ISE-BSE-10K=

L-ISE-ADV3Y-10K=

L-ISE-ADV5Y-10K=

L-ISE-AD3Y-W-10K=

L-ISE-AD5Y-W-10K=

L-ISE-W-3UPG-10K=

L-ISE-W-UPG-10K=

25,000

25,000

L-ISE-BSE-25K=

L-ISE-ADV3Y-25K=

L-ISE-ADV5Y-25K=

L-ISE-AD3Y-W-25K=

L-ISE-AD5Y-W-25K=

L-ISE-W-3UPG-25K=

L-ISE-W-UPG-25K=

50,000

50,000

L-ISE-BSE-50K=

L-ISE-ADV3Y-50K=

L-ISE-ADV5Y-50K=

L-ISE-AD3Y-W-50K=

L-ISE-AD5Y-W-50K=

L-ISE-W-3UPG-50K=

L-ISE-W-UPG-50K=

100,000

100,000

L-ISE-BSE-100K=

L-ISE-ADV3Y-100K=

L-ISE-ADV5Y-100K=

L-ISE-AD3Y-W-100K=

L-ISE-AD5Y-W-100K=

L-ISE-W-3UPG-100K=

L-ISE-W-UPG-100K=

Table 7. Cisco ISE License Packages: New Part Numbers

License Tiers (T)

Number of Endpoints Supported

Advanced Subscription Licenses

Wireless Subscription Licenses

Wireless Upgrade Subscription Licenses

100

100

L-ISE-ADV-S-100=

L-ISE-W-S-100=

L-ISE-WU-S-100=

250

250

L-ISE-ADV-S-250=

L-ISE-W-S-250=

L-ISE-WU-S-250=

500

500

L-ISE-ADV-S-500=

L-ISE-W-S-500=

L-ISE-WU-S-500=

1,000

1,000

L-ISE-ADV-S-1K=

L-ISE-W-S-1K=

L-ISE-WU-S-1K=

1,500

1,500

L-ISE-ADV-S-1500=

L-ISE-W-S-1500=

L-ISE-WU-S-1500=

2,500

2,500

L-ISE-ADV-S-2500=

L-ISE-W-S-2500=

L-ISE-WU-S-2500=

3,500

3,500

L-ISE-ADV-S-3500=

L-ISE-W-S-3500=

L-ISE-WU-S-3500=

5,000

5,000

L-ISE-ADV-S-5K=

L-ISE-W-S-5K=

L-ISE-WU-S-5K=

10,000

10,000

L-ISE-ADV-S-10K=

L-ISE-W-S-10K=

L-ISE-WU-S-10K=

25,000

25,000

L-ISE-ADV-S-25K=

L-ISE-W-S-25K=

L-ISE-WU-S-25K=

50,000

50,000

L-ISE-ADV-S-50K=

L-ISE-W-S-50K=

L-ISE-WU-S-50K=

100,000

100,000

L-ISE-ADV-S-100K=

L-ISE-W-S-100K=

L-ISE-WU-S-100K=

New Cisco ISE Subscription Licenses

Table 7 lists the new subscription licenses for Cisco ISE. Unlike the older licenses, the new licenses offer renewal capabilities and the ability to support coterming. The new subscription part numbers look similar to the older ones, but contain an “S“ within the part number. The pricing for the new licenses has not changed.

When a new license is ordered, the appropriate part number from Table 7 is entered into the system. The default term is 3 years. However, there is a configuration option (Edit Subscriptions) that allows the term to be changed to 1 or 5 years. The term selected will appear as a separate part number in the ordering tool.

It should be noted the list price of the subscription license is $0 (zero dollars). The license price is associated with term license part number. For discounting operations, the discount should be applied to the term option part number, not the license part number.

The new Cisco ISE subscription license part numbers can be located in the Cisco price list under the subheadings Cisco ISE Advanced Subscription Licenses, Cisco ISE Wireless Subscription Licenses, and Cisco ISE Wireless Upgrade Subscription Licenses.

The new Cisco ISE term option part numbers can be located in the Cisco price list under the subheadings Cisco ISE Advanced Subscription Term Options, Cisco ISE Wireless Subscription Term Options, and Cisco ISE Wireless Upgrade Subscription Term Options.

It is highly recommended that orders for Cisco ISE Advanced, Wireless, and Wireless Upgrade licenses be made using the new subscription licenses.

Note: Cisco ISE customers must have an active and valid SMARTnet or SASU contract for the appliances in the deployment to install any of the licenses described in this section.

Step 6: Select the Appropriate Level of Services

Deploying the Cisco Identity Services Engine in an organization touches many geographic, functional, and political boundaries. For a successful deployment, customers must engage either a Cisco Certified Partner or Cisco Advanced Services for the design, deployment, and sustaining engineering of the Cisco ISE.

Cisco Advanced Services has developed a number of packages to meet program requirements and customer expectations. Table 8 lists two available Advanced Services Fixed-Price options.

Table 8. Cisco ISE Physical Appliance Support

Cisco Advanced Services Fixed - Price Part Number

Product Description

ASF-CORE-ISE-DSGN

Cisco ISE Design Service Package

ASF-CORE-ISE-POC

Cisco ISE Design and Proof-of-Concept Service Package

For more information about these Cisco Advanced Services Fixed-Price Services, visit:
http://www.cisco.com/web/about/doing_business/legal/service_descriptions/docs/ASF_Identity_Services_Engine_Design.pdf
http://www.cisco.com/web/about/doing_business/legal/service_descriptions/docs/ASF_Identity_Services_Engine_Design_and_Proof_of_Concept.pdf

Cisco partners can additionally purchase the Cisco ISE Design Guidance service package to help them validate their designs. Please refer to the following link for more information:
http://www.cisco.com/web/about/doing_business/legal/service_descriptions/docs/CPS_ISE_Planning_and_Design_Guidance_Service.pdf

For engaging Cisco Advanced Services or to learn more about the service packages, please contact Jazib Frahim (jfrahim@cisco.com). Cisco employees may visit: http://collaboratory.cisco.com/confluence/display/CAWIKI/ISE.FixedPriced.

For Presales Assistance

For Cisco presales support, please consult the help desk. The help desk is open 24 hours Monday through Friday, in all countries.

Phone: 408 902-4872

Email: sac-support@cisco.com

Live chat: http://tinyurl.com/sacise

For More Information

For more information about the Cisco ISE, visit http://www.cisco.com/go/ise or contact your local account representative.