Explore Cisco
How to Buy

Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco ISE License FAQ

Available Languages

Download Options

  • PDF
    (156.3 KB)
    View with Adobe Reader on a variety of devices
Updated:August 24, 2021

Available Languages

Download Options

  • PDF
    (156.3 KB)
    View with Adobe Reader on a variety of devices
Updated:August 24, 2021


The Simplified VM License, Virtual Machine Common License, in ISE 3.1

Q.  Why is the simplified VM license required?
A.  Cisco ® Identity Services Engine (ISE) is now available from the cloud, enabling you to scale your Cisco ISE deployments quickly and easily to meet changing business needs. Cisco ISE is available as an infrastructure-as-code solution, helping you to rapidly deploy network accesses and control services anywhere. Extend the Cisco ISE policies in your home network to new remote deployments securely through AWS. There are three types of Cisco ISE instances in AWS, and you can configure your Policy Administration Nodes (PAN) or Monitoring and Troubleshooting (MnT) nodes on the instances. Because you can select Cisco ISE Instance types based on your own needs, Cisco doesn’t have multiple tiers in the Virtual Machine license. As such we introduced the simplified VM licenses for all the VM customers.
Q.  What do I do with my existing license?
A.  You can use your existing license unless you upgrade your ISE to 3.1 and later. If you upgrade your ISE to 3.1 and later, you need to migrate your VM Small, Medium, and/or Large license to VM Common license. Please refer to ISE Migration Guide for the VM license migration. Once you migrate your VM license to VM Common license, you can use the VM Common license even if you downgrade your ISE to 3.0 or earlier as the VM Common license covers VM Small, Medium, and Large licenses.
Q.  How do I ensure my support contract stays active?
A.  Your existing support contract is active until its original expiry.
Q.  How can I renew my support contract?
A.  You can renew your support contract as you did until the legacy VM license is EOL’d and reaches the last date of the service renewal per the EOL bulletin. Once the underlying VM license PID is EOL’d, you need to purchase the new support contract that is attached to the VM Common PID.

Essentials, Advantage, and Premier licenses in ISE 3.0

Q.  What does the new license model look like?
A.  Cisco ISE 3.0 introduces new license types. These licenses are in the same format as Cisco DNA Center licenses, bringing the same approach to ISE. The three tiers of Cisco ISE licenses are Essentials, Advantage, and Premier. These replace the ISE Base, Plus, and Apex licenses. These are in the nested doll model, which means that the features in the Essentials license are included within Advantage and features in Advantage are included in Premier. The features in each license are as follows.

Premier (Full Stack)

  Posture Visibility and Enforcement
  MDM Visibility and Enforcement
  TC-NAC Visibility and Enforcement


Advantage (Context)

  Context Sharing (pxGrid Out/In)
  Profiling Enforcement
  AI Endpoint Analytics Enforcement
  Group-Based Policy (TrustSec)
  BYOD (+CA, +MDP)
  Profiling Visibility
  AI Endpoint Analytics Visibility


  User-Defined Network


Essentials (User Visibility and Enforcement)


  AAA and 802.1X
  Guest (Hotspot, Self-Reg, Sponsored)
  Easy Connect (PassiveID)


Q.  Are any of these perpetual licenses?
A.  All the license types above are subscription based. They are offered in 1-, 3-, and 5-year terms. The new license types, Essentials, Advantage, and Premier, replace the Base, Plus, and Apex licenses. These do no impact Device Administration, VMs, and IPSec licenses.
Q.  What is the benefit of the new license structure compared to the previous one?
A.  These licenses are introduced based on feedback from customers. The key driver was making licenses simple across Cisco products. Hence, with this change, Cisco is aligning ISE licenses with Cisco DNA Center licenses to make it easier to understand the tiers across the networking portfolio.
The new licenses adopt a nested tier structure, whereby, Premier contains all of the features in Advantage plus some additional features; Advantage contains all of the features in Essential plus some additional features. This allows customers to purchase only Advantage or only Premier if needed.
Moreover, all the Essentials, Advantage, and Premier licenses include Software Support Basic.
Q.  Do I need to purchase Essentials first before purchasing Advantage or Premier?
A.  No, with the new model, a customer can directly purchase Premier or Advantage licenses without the need for an Essentials license.
Q.  Can I buy a mix of Cisco ISE Essentials, Advantage, and Premier licenses and install them?
A.  Yes, one can purchase and install a combination of Essentials, Advantage, and Premier licenses as needed.
Q.  How do these licenses compare vis-à-vis the old licenses?
A.  The new licenses have a different model compared to the old Base, Plus, and Apex licenses. Having said that, one can think of Essentials as being equivalent to a Base and an Advantage as being equivalent to a Base and Plus, while a Premier is equivalent to a Base, Plus, and Apex together.
Q.  How do I receive the new ISE licenses?
A.  The new licenses have a different model compared to the old Base, Plus, and Apex licenses. The main two being - 1) a nested tier compared to a lego-like mode earlier; and 2) Smart Only.
The new licenses are Smart License only. This means there will be no PAKs and customers will require a Smart Account to purchase and consume the licenses.
Q.  Can I use my existing ISE licenses on the ISE 3.0 software release?
A.  No, ISE 3.0 will need the new ISE Essentials, Advantage, or Premier licenses. Customers can migrate their ISE Base, Plus, and Apex licenses to the corresponding ISE Essentials, Advantage, and Premier licenses. The ISE Base licenses will migrate to the new subscription model. Please follow the migration guide in the ISE Migration Guide.
Q.  When a customer upgrades to Cisco ISE 3.0, will all of the features work after device reboot?
A.  If upgrading to 3.0 from an existing 2.X release, it is required that a customer migrate their existing licenses to the new licenses and then upgrade to the 3.0 release. Please refer to the Migration Guide for instructions.
Features on ISE 3.0 will be based on the Feature-License mapping as displayed above.
Q.  How do renewals work?
A.  Customers who are on ISE 2.X can continue to purchase the Plus and Apex licenses for renewals. Customers who are upgrading to ISE 3.0 will need to convert their licenses to the new structure. Renewals of the new licenses will be the same after that. Please refer to the migration guide on migrations and renewals.
Q.  Will I be notified before my license expires?
A.  Yes, ISE will continue to follow the same notification as before with notification on expiry beginning at 90 days prior to expiry.
Q.  Does basic ISE behavior change with the new licenses?
A.  No, we have retained the behavior of ISE with respect to licenses as before. For example, the license expiry notifications, behavior of ISE on expired licenses, and grace periods are still the same.
Q.  Is there any impact to Device Administration?
A.  No, there is no change to the Device Administration license. However, one benefit is that the ISE Device Administration license/s can now be installed directly and will NOT require any license as a prerequisite.
Q.  What support do customers receive with the new ISE licenses?
A.  The same as with current subscription licenses. With the new ISE software licenses, customers receive embedded SWSS—which covers 24x7x365 Cisco Technical Assistance Center (TAC) support and software updates. However, now Essentials will also have this support.

Cisco Smart Accounts

Q.  What is a Smart License and why should I care?
A.  Smart Licensing is a new, flexible software-licensing model that simplifies the way customers activate and manage licenses across their organization. Instead of using Product Activation Keys (PAKs), Smart Licenses establish a pool of software licenses in a customer-defined Smart Account that can be used throughout the enterprise.
Q.  What are Smart Accounts? Why should I care?
A.  Smart Accounts are mandatory for any subscription. They help identify and connect the right customer account into which the subscription licenses purchased by the customer will be deposited before they may be used. The combination of Smart Licensing and Smart Accounts delivers visibility into your license ownership and consumption (through a cloud portal) to help you reduce operational costs.
Q.  What software products offer Smart Account and Smart License capabilities?
A.  More and more Cisco products are offered only through a Smart Account, including Cisco ISE software.
Q.  How do I view and use a Smart License?
A.  License availability and consumption through a Smart License is visible through a portal called Cisco Smart Software Manager (CSSM) at software.cisco.com. All licenses that are deposited and consumed are clearly visible through the user id and password provided for the Smart or Virtual Account for each customer.
Q.  What software products offer Smart Licenses?
Q.  Where can I learn more about Cisco Smart Software Licensing and Smart Accounts?

Cisco Enterprise Agreement

Q.  A customer would like to upgrade from Cisco ISE Advantage to Premier within an Enterprise Agreement (EA). Can they upgrade the license tier mid-term?
A.  Yes. Within an EA, customers can upgrade from Cisco ISE Advantage to Premier and receive a 100 percent credit for the residual Cisco ISE Advantage term. The customer would pay for the upgrade at True Forward.
Q.  What value do I receive through a Cisco EA?
A.  Cisco EA enables accelerated value realization. Some of the key value additions are:

      Easy to buy: Three simple and flat-rate pricing tiers, financial predictability, upfront or annual payment terms, a cross-platform buying platform, unique value within each enrollment, Not To Exceed (NTE) Pricing, simplified installation base assessment, ability to upgrade tiers, and payable at True Forward.

      Easy to consume: True Forward (no retroactive billing), access to new software capabilities, on-demand deployment, flexibility of bandwidth growth within a tier without additional cost.

      Easy to manage: Know where you stand with an EA workspace, co-termination of software subscriptions, and service-level assurance.

Q.  Which type of customers should consider EA?
A.  Customers who are looking for the following should consider EA:

      Standardization: Cross-architecture standardization

      Full coverage: 100 percent organization coverage

      Ease of management: Centralized license management, co-termination, and procurement

      Predictability: Predictable budget and pricing

      Relationship: Strategic multiyear relationship

Q.  Can I still buy Cisco ONE through EA, as before?
A.  No. Cisco EA will offer Cisco ISE Advantage or Premier.
Q.  I have an active Cisco ISE subscription through an EA. How will the migration to Cisco ISE subscription work?
A.  There is no change required to their current licensing; all existing licenses will still be valid. As always, we recommend customers use a supported ISE Software release in their production deployment.




Learn more