Cisco Identity Services Engine Hardware Installation Guide, Release 1.2
Cisco ISE Licenses
Downloads: This chapterpdf (PDF - 93.0KB) The complete bookPDF (PDF - 8.0MB) | Feedback

Table of Contents

Cisco ISE Licenses

Cisco ISE Licensing

License Count

Obtaining a Cisco ISE License from Cisco.com

Determining Your Hardware ID Using the CLI

Determining Your Hardware ID Using the Admin Portal

Adding or Upgrading a License

Removing a License

Cisco ISE Licenses

This chapter describes the licensing mechanism and schemes that are available for Cisco ISE and how to add and upgrade licensees.

Cisco ISE Licensing

Cisco ISE licensing provides the ability to manage the application features and access, such as the number of concurrent endpoints that can use Cisco ISE network resources.

To help you select the features you want, licensing in Cisco ISE is granular. Cisco offers multiple license packages, such as Base, Plus, and Advanced.

 

Table 1-1 Cisco ISE License Packages

License Package
Perpetual or Subscription
ISE Functionality Covered
Notes

Base

Perpetual

  • Basic network access: AAA, IEEE-802.1X
  • Guest management
  • Link encryption (MACSec)

Plus

Subscription (1, 3, or 5 years)

  • Bring Your Own Device (BYOD)
  • Profiling
  • Endpoint Protection Service (EPS)
  • TrustSec SGT

Does not include Base services. A Base license is required for each Plus license.

Advanced

Subscription (1, 3, or 5 years)

  • Bring Your Own Device (BYOD)
  • Profiling
  • Endpoint Protection Service (EPS)
  • TrustSec SGT
  • Mobile Device Manager (MDM)
  • Health Compliance and Remediation
  • Posture

Does not include Base services. A Base license is required for each Advanced license. The Advanced license includes all the functionality of Plus license.

Wireless

Subscription (1, 3, or 5 years)

A Wireless license turns on the functionality of Base and Advanced licenses for wireless LAN deployments.

Cannot coexist on a Cisco Administration node with Base, Plus, or Advanced Licenses.

Wireless Upgrade

Subscription (1, 3, or 5 years)

A Wireless Upgrade license turns on the functionality of Base and Advanced licenses for all wireless and non-wireless client-access methods, including wired and VPN Concentrator access.

You can only install a Wireless Upgrade License on top of an existing Wireless license.

Evaluation

Temporary (90 days)

Full Cisco ISE functionality is provided for 100 endpoints.

Limited use of Cisco ISE product for pre-sale customer evaluations. All Cisco ISE appliances are supplied with an Evaluation license.

All Cisco ISE appliances are supplied with a 90-day Evaluation license. To continue to use Cisco ISE services after the 90-day Evaluation license expires, and to support more than 100 concurrent endpoints on the network, you must obtain and register Base licenses for the number of concurrent users on your system. If you require additional functionality, you will need Plus or Advanced licenses to enable that functionality.

After you install the Cisco ISE software and initially configure the appliance as the primary Administration node, you must obtain a license for Cisco ISE and then register that license.

Cisco ISE supports licenses with two hardware IDs. You can obtain a license based on the hardware IDs of both the primary and secondary Administration nodes. You register all licenses to the Cisco ISE primary Administration node via the primary and secondary Administration node hardware ID. The primary Administration node then centrally manages all the licenses that are registered for your deployment.


Note You always require a Base license. However, you do not need a Plus license in order to have an Advanced license or vice versa.


Cisco recommends installing the Base, Plus, and Advanced Licenses at the same time.

  • When you install a Base License over a default Evaluation License, the Base License overrides only the base license-related portion of the Evaluation License and keeps the Plus and Advanced License capabilities available for the remainder of the default Evaluation License duration.
  • You cannot upgrade the Evaluation License to a Plus or Advanced License without first installing the Base License.
  • When you install a Wireless License over a default Evaluation License, the Wireless License overrides the Evaluation License parameters with the specific duration and user count associated with the Wireless License.

License Count

A Cisco ISE user consumes a license during an active session. Once the sessions has ended, ISE releases the license for reuse by another user.

The Cisco ISE license is counted as follows:

  • A Base, Plus, or Advanced license is consumed based on the feature that is used.
  • An endpoint with multiple network connections can consume more than one license per MAC address. For example, a laptop connected to wired and also to wireless at the same time. Licenses for VPN connections are based on the IP address.
  • Licenses are counted against concurrent, active sessions. An active session is one for which a RADIUS Accounting Start is received but RADIUS Accounting Stop has not yet been received.

Note Sessions without RADIUS activity are automatically purged from Active Session list every 5 days or if the endpoint is deleted from the system.


To avoid service disruption, Cisco ISE continues to provide services to endpoints that exceed license entitlement. Cisco ISE instead relies on RADIUS accounting functions to track concurrent endpoints on the network and generate alarms when endpoint counts exceed the licensed amounts:

  • 80% Info
  • 90% Warning
  • 100% Critical

Obtaining a Cisco ISE License from Cisco.com

To continue to use Cisco ISE services after the 90-day Evaluation License expires, and to support more than 100 concurrent endpoints on the network, you must install a Base, Plus, Advanced, or Wireless license package for Cisco ISE. License files are based on a combination of the Cisco ISE hardware ID and Product Authorization Key (PAK). When you purchase Cisco ISE, or before the 90-day license expires, you can research the licensing options on Cisco.com and order the package that is suitable for your deployment of Cisco ISE.

If you have two Administration nodes deployed in a high-availability pair, you must ensure each of them have the same license capabilities and add the licenses while the node is in a standalone or primary state.

Within an hour of ordering your license files from Cisco.com, you should receive an e-mail with the Cisco Supplemental End-User License Agreement and a Claim Certificate containing a PAK for each license that you order. After receiving the Claim Certificate, you can log in and access the Cisco Product License Registration website at http://www.cisco.com/go/license and provide the appropriate hardware ID information and PAK to generate your license.

You must supply the following specific information to generate your license file:

  • Product identifier (PID) of both the primary and secondary Administration nodes
  • Version identifier (VID)
  • Serial number (SN)
  • PAK

See the Cisco Identity Services Engine Licensing Note for more details.

The day after you submit your license information in the Cisco Product License Registration website, you will receive an e-mail with your license file as an attachment. Save the license file to a known location on a local machine and use the instructions in Adding or Upgrading a License to add and update any product licenses for Cisco ISE.

For detailed information and license part numbers that are available for Cisco ISE, including licensing options for new installations as well as migration from an existing Cisco security product like Cisco Secure Access Control Server, see the Cisco Identity Services Engine Ordering Guidelines at http://
www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/guide_c07-656177.html
.

Related Topics

Determining Your Hardware ID Using the CLI

Cisco ISE licenses are generated based on the Administration node hardware ID, not the MAC address.

To determine the Hardware ID, access the Cisco ISE direct-console CLI and enter the show inventory command. The output includes a line showing the PID, VID, and SN, similar to the following:

PID: NAC3315, VID: V01, SN: ABCDEFG

Determining Your Hardware ID Using the Admin Portal

Cisco ISE licenses are generated based on the Administration node hardware ID, not the MAC address.

If your current license has not expired, you can view the Administration node hardware ID by completing the following steps:


Step 1 From the Cisco ISE Administration interface, choose Administration > System > Licensing.

Step 2 In the License Operations navigation pane, click Current Licenses.

Step 3 Select the button corresponding to the Cisco ISE node that you want to check for the Administration node hardware ID, and click Administration Node to view the PID, VID, and SN.


 

Adding or Upgrading a License

You can add a license only on a standalone or a primary Administration node. You can upgrade your existing Evaluation License on or before the expiration of the 90-day evaluation period. You have two options for upgrading or replacing your Evaluation License:

  • Install a Base license and then choose whether to also install a Plus or Advanced license
  • Install a Wireless license

A single endpoint with multiple network connections may consume more than one Base, Plus, or Advanced License. This situation can occur, for example, if an endpoint has both a wired and a wireless network connection. Each unique authenticated connection will require its own license.

Before You Begin

Make sure that you have obtained and installed an appropriate license on your Cisco ISE node. See Obtaining a Cisco ISE License from Cisco.com for more information.


Step 1 From the Cisco ISE Administration interface, choose Administration > System > Licensing > Current Licenses.

Step 2 Click the radio button next to the license name that you want to upgrade, and click Edit.

Step 3 Click Add Services.

Step 4 Click Browse and select the Licence file.

Step 5 Click Import to import the new license file that supports the added service.

Step 6 Go back to the Current Licenses page to verify the addition of the upgraded license. For further confirmation, check the features of the respective services for which the license has been upgraded.


Note The Current Licenses page displays the number of installed Plus and Advanced licenses in a combined Advance/Plus Counter. For example, if you have installed 500 Plus licenses and 1000 Advanced licenses, the Advance/Plus Counter displays 1500.



 

Related Topics

Removing a License

You can remove individual Base, Plus, Advanced, and Wireless licenses, but keep in mind the following conditions:

  • If the Plus or Advanced license count is greater than the Base license count, then the Base license cannot be deleted.
  • If you install a combined license, all related installations in the Base and Advanced packages are also removed.
  • If you remove a production-level license within the standard 90-day evaluation period, the Evaluation License is automatically restored after you remove the production license.
  • You cannot remove Evaluation Licenses.

Before You Begin

If you have installed a Wireless Upgrade license after a Wireless license, you must remove the Wireless Upgrade license before you can remove the underlying Wireless license.


Step 1 Choose Administration > System > Licensing > Current Licenses.

Step 2 Click the radio button next to the relevant node name, and click Edit.

Step 3 Click the radio button next to the license name that you want to delete and click Remove.

Step 4 Click OK.