Cisco ISE Licenses

This chapter describes the licensing mechanism and schemes that are available for Cisco ISE and how to add and upgrade licenses.

Cisco ISE Licenses

Cisco ISE licensing offers two options to manage your licenses:

Smart Licensing—Monitor ISE software licenses and endpoint license consumption easily and efficiently with a single token registration. The licenses that you have purchased are maintained in a centralized database called the Cisco Smart Software Manager (CSSM). For more information about Smart Licensing, seeCisco ISE Smart Licensing Cisco ISE Smart Licensing.
Traditional Licensing—Purchase and import individual licenses based on your needs and manage the application features and access, such as the number of concurrent endpoints that can use Cisco ISE network resources. For more information about Traditional Licensing, see Manage Traditional License Files.

To maximize economy for customers, licensing in Cisco ISE is supplied in different packages as Base, Plus, Apex, and Device Administration for both Traditional and Smart Licensing options. For more information about the Traditional Cisco licensing model, see Cisco ISE Licensing Model.

Once you have installed or upgraded your ISE box, Traditional Licensing is in use by default, and all license components are activated for a 90-day trial period. Once you switch to Smart Licensing, and before you register your token, this evaluation period remains active for the Smart Licensing, and the evaluation period includes all ISE licenses as part of that evaluation period. During the evaluation period, consumption is not reported to the CSSM.

The trial period ends and you have not yet installed or registered your license.
Your license has expired.
If endpoint consumption exceeds your licensing agreement.

Cisco ISE Smart Licensing

Cisco offers Smart Licensing, which enables you to monitor ISE software licenses and endpoint license consumption easily and efficiently with a single token registration, rather than individually importing separate licenses. Details of all Cisco products and licenses that you have purchased are maintained in a centralized database, called the Cisco Smart Software Manager (CSSM), where you can easily track which endpoint licenses are available to you, and consumption statistics.

When a smart license token is activated and registered from ISE, it monitors consumption of licenses by each endpoint session per product license. Smart Licensing notifies the administrator about license consumption by endpoint sessions from a simple table layout in ISE. Smart Licensing reports the peak usage of each enabled license to the centralized database daily. When licenses are available and not consumed, the administrator is notified of available licenses and can continue to monitor usage. When consumption exceeds the amount of licenses available, an alarm is activated and the administrator is notified through alarms and notifications.

With Smart Licensing, you can also manage the different license entitlements included through your Cisco Smart Account, such as Base, Plus, Apex, or TACACS. From ISE, you can monitor basic consumption statistics per license entitlement. From your CSSM account, you can also view additional information, statistics and notifications, as well as make changes to your account and entitlements.

Note

Cisco Smart Software Manager satellite is not supported.

ISE takes internal samples of license consumption every 30 minutes, and compliancy and consumption is updated accordingly. To view this information in the Licenses table in ISE, you need only click Refresh. At 1:00 AM every day, ISE reports peak counts daily to the CSSM server (the centralized database) based on the Yesterday's Peak Count data that is also displayed in the Licenses table, for each enabled license. ISE communicates with the CSSM server by storing a local copy of the CSSM certificate, which is automatically re-authorized during the daily synchronization, and also when the user manually refreshes the Licenses table. Typically, certificates are valid for six months. If compliancy changes when synchronized with the CSSM server, the Last Authorization column of the Licenses table updates accordingly. In addition, when entitlements are no longer compliant, the number of days for which they are out of compliancy appears in the Days Out of Compliancy column. Non-compliancy is also indicated in Notifications at the top of the Licensing area, and on the ISE toolbar at the License Warning link. In addition to notifications, you can view Alarms.

Note

TACACS licenses are authorized when ISE communicates with the CSSM server, but they are not session-based and therefore no consumption count is associated with them in the Licenses table.

Activate and Register Smart Licensing in ISE

Before you begin

Activate Smart Licensing and then register from Cisco ISE using the token issued to you by your Cisco representative through your CSSM account.

Ensure you have the necessary ISE permissions in your Cisco Smart Software Manager (CSSM) account. For more information, see https://software.cisco.com/ or contact your Cisco representative.

If you are upgrading from ISE-PIC, then prior to activating Smart Licensing with this procedure, you must first install the ISE Upgrade license and then:

Install the ISE Base license.
Or, move your PIC installation to an existing ISE deployment:
1. From the existing ISE deployment, add another ISE node.
2. Enable session profiling and pxGrid services from an existing ISE Administration node.

Procedure

Step 1

Choose Administration > System > Licensing to access the Licensing area of ISE.

After you install or upgrade Cisco ISE, traditional licensing is in use by default. The licensing mode appears at the top of the screen in the Licensing Method area of ISE:

Step 2

Click the Cisco Smart Licensing link from the Licensing Method area to switch to Smart Licensing.

The Cisco Smart Licensing area expands with connection method fields.

Figure 3. Smart Licensing Connection Method Details

Step 3

From the Cisco Smart Licensing area, in the Secondary UDI field, if at least one additional ISE box is configured in your network, enter the secondary node you to be used if the Primary node is not available. Select a connection method by which to connect from your ISE box to the CSSM from the Connection Method dropdown list and click Enable. For Connection Method, choose:

Direct HTTPS if you have a direct connection configured to reach the Internet.
HTTPS Proxy if you do not have a direct connection and need to connect by proxy.
Transport Gateway is the recommended connection method.

When you use Smart Licensing, Smart Call Home (SCH) services are automatically activated as well, enabling you to configure a Transport Gateway. To configure Transport Gateway as your connection method, first configure it from the Smart Call Home settings in the Administration work center. To do this, and for additional information about SCH and Transport Gateway, see the Smart Call Home section in the Cisco ISE Admin Guide.

Note

After activating Smart Licensing, you have a 90-day evaluation period. During this time, all licenses are active. During this time, you can explore Smart Licensing and all the Cisco ISE features. If you don't register Smart Licensing with a valid token before the evaluation period expires, you cannot use Cisco ISE.

The fields in this area are dynamic. After you enter the connection details and click Enable, the area collapses. When you expand the area again, is now called Cisco Smart Licensing Registration, and you can enter smart licensing token details.

Figure 4. Cisco Smart Licensing Registration

Step 4

From the Cisco Smart Licensing Registration area in ISE, enter the Registration Token you received when you purchased the smart licensing token, and click Register. To retrieve the token at any time, go to the ISE area of your CSSM account and click Copy.

You can disable any of the licenses in your smart licensing token by removing the checkmarks. When you disable the licenses, Smart Licensing no longer automatically validates those licenses.

Manage Smart Licensing in ISE

Once you have activated and registered your Smart Licensing token, you can manage license entitlements from ISE by:

Enabling, disabling and refreshing license entitlement certificates.
Updating Smart Licensing registration.
Identifying compliant and non-compliant licensing issues.

Before you begin

Ensure you have activated and registered your Smart Licensing token. For more information, see Activate and Register Smart Licensing in ISE.

Procedure

Step 1	When you first activate Smart Licensing, all license entitlements are enabled automatically as part of the evaluation period. Once you register your token, if your CSSM account does not include certain entitlements and you did not disable them during registration, non-compliant notifications will appear in ISE. Add those entitlements to your CSSM account (contact your CSSM account representative for assistance), and then from the Licenses table, click Refresh to remove non-compliant notifications and continue to use the related features. Once you have refreshed authorization, log out and then log back in to ISE for the relevant non-compliancy messages to be removed.
Step 2	If the daily automatic authorization does not succeed for any reason, non-compliancy messages may appear. Click Refresh to re-authorize your entitlements. Once you have refreshed authorization, log out and then log back in to ISE for the relevant non-compliancy messages to be removed.
Step 3	When you first activate Smart Licensing, all license entitlements are enabled automatically as part of the evaluation period. Once you register your token, if your CSSM account does not include certain entitlements and you did not disable them during registration, you can still disable those entitlements from Smart Licensing in ISE in order to avoid unnecessary non-compliant notifications. From the Licenses table, checkmark the license entitlements that are not included in your token, and click Disable from the toolbar. Once you have disabled license entitlements, log out and then log back in to ISE for the relevant features to be removed from the menus and for the non-compliancy messages to be removed.
Step 4	Once you add entitlements to your account, enable those entitlements. From the Licenses table, checkmark the required disabled licenses and click Enable from the toolbar.
Step 5	If you initially set-up Smart Licensing with only one UDI and do not enter a Secondary UDI, you can later update your information. Click the Cisco Smart Licensing Registration Details link to open the area. Re-enter the token, enter the new Secondary UDI and click Update.
Step 6	The registration certificate is automatically refreshed every six months. To manually refresh your Smart Licensing certificate registration, click Renew Registration from the top of the Cisco Smart Licensing area.
Step 7	To remove your ISE box registration (indicated by UDIs) from your Smart Account but continue to use Smart Licensing to the end of the evaluation period, click Deregister from the top of the Cisco Smart Licensing area. You can do this, for example, if you need to change the UDIs you have indicated as part of the registration process. If you still have time remaining in your evaluation period, ISE remains in Smart Licensing. If you have no time remaining in your evaluation period, a notification appears when the browser refreshes. Once you deregister, you can follow the registration process again in order to register with the same or different UDIs. For more information about activating and registering your Smart Licensing, see Activate and Register Smart Licensing in ISE.
Step 8	To remove your ISE box registration (indicated by UDIs) from your Smart Account entirely and to revert to traditional licensing, click Disable from the top of the Cisco Smart Licensing area. You can do this, for example, if you need to change the UDIs you have indicated as part of the registration process. Once you disable, you can follow the registration process again in order to activate and register with the same or different UDIs. For more information about activating and registering your Smart Licensing, see Activate and Register Smart Licensing in ISE.

Manage Traditional License Files

To continue to use Cisco ISE services after the 90-day Evaluation license expires, and to support more than 100 concurrent endpoints on the network, you must obtain and register Base licenses for the number of concurrent users on your system. If you require additional functionality, you will need Plus and/or Apex licenses to enable that functionality.

Licenses are uploaded to the Primary Policy Administration Node and propagated to the other Cisco ISE nodes in the cluster. Licenses are centrally managed by the Administration node, the other nodes do not require separate licenses. If you have two Administration nodes deployed in a high-availability pair, you must ensure that each of them have the same license capabilities. Generate the license with both the UDIs of the Primary and the Secondary Policy Administration Nodes and then add the license to the Primary Policy Administration Node.

After you install the Cisco ISE software and initially configure the appliance as the PAN, you must obtain a license for Cisco ISE and then register that license. You register all licenses to the PAN via the Primary and Secondary Administration Node hardware UDI. The PAN then centrally manages all the licenses that are registered for your deployment.

Note

When a node is deregistered from the PAN, it becomes a standalone node and its license is reset to Evaluation.

This section explains how to register, re-host, renew, migrate, upgrade, and remove Traditional ISE licenses.

Register Licenses
Re-Host Licenses
Renew Licenses
Migrate and Upgrade Licenses
Remove Licenses

Cisco ISE Licensing Model

Cisco ISE licensing model allows you to purchase licenses based on your enterprise's needs. When using Traditional Licensing, you import all individual licenses and continue to manage them individually from ISE. When using Smart Licensing, you manage a centralized Cisco account, which contains all information about the different endpoint licenses you have purchased.

Valid license options include:

ISE Base only
ISE Base and Plus
ISE Base and Apex
ISE Base and Device Administration
ISE Base, Plus, Apex, and Device Administration
ISE Base, Plus, Apex and AnyConnect Apex

The number of Plus license sessions can be up to the number of Base license sessions on the deployment. The same stands for Apex license sessions. Apex and Plus licenses can be installed independently without any restriction on the number of Apex versus Plus licenses. Cisco ISE licenses are based on the number of concurrent endpoints with active network connections whereas AnyConnect Apex licenses are on a per user basis. AnyConnect Apex license count can exceed Cisco ISE Base license count.

Note

The services contained within the Plus license, most notably profiling, are frequently used across the entire deployment. When you add Plus licenses to the deployment, we recommend that the Plus license count be equal to the Base license count. However, you might have a situation where the Plus license services might not be needed across the entire deployment, which is why Cisco ISE allows the Plus license count to be less than the Base license count.

Cisco recommends installing (for Traditional Licensing), or purchasing (for Smart Licensing) Base, Plus, and Apex licenses at the same time.

Base licenses are required to use the services enabled by Plus and/or Apex licenses. However, you do not need a Plus license in order to have an Apex license or vice versa, since there is no overlap in their functionality.
When you install a Base or Mobility Upgrade license, Cisco ISE continues to use the default Evaluation license as a separate license for the remainder of its duration.
When you install a Mobility Upgrade license, Cisco ISE enables all Wired, Wireless, and VPN services.
A Base or Mobility license is required to install the Device Administration license.
You cannot upgrade the Evaluation license to a Plus license without first installing the Base license.

Table 1. Cisco ISE License Packages

ISE License Packages

Perpetual/Subscription (Terms Available)

ISE Functionality Covered

Notes

Base

Perpetual

Basic network access: AAA, IEEE-802.1X
Guest services
Link encryption (MACSec)
TrustSec
ISE Application Programming Interfaces

Plus

Subscription (1, 3, or 5 years)

Bring Your Own Device (BYOD)—when consuming either a built-in or an external certificate authority
MSE integration for location services
Profiling and Feed Services
Adaptive Network Control (ANC)
Cisco pxGrid

Does not include Base services; a Base license is required to install the Plus license.

When onboarding an endpoint with the BYOD flow, the Plus services are consumed on the active session even when related BYOD attributes are not in use.

Apex

Subscription (1, 3, or 5 years)

Third Party Mobile Device Management (MDM) integration
Posture Compliance
TC NAC

Does not include Base services; a Base license is required to install the Apex license.

Note

When you use Cisco AnyConnect as unified posture agent across wired, wireless, and VPN deployments, you need Cisco AnyConnect Apex user licenses in addition to Cisco ISE Apex licenses.

Mobility

Subscription (1, 3, or 5 years)

Combination of Base, Plus, and Apex for wireless and VPN endpoints

Cannot coexist on a Cisco Administration node with Base, Plus, and/or Apex licenses.

Mobility Upgrade

Subscription (1, 3, or 5 years)

Provides wired support to Mobility license

You can only install a Mobility Upgrade license on top of an existing Mobility license.

Device Administration

Perpetual

TACACS+

A Base or Mobility license is required to install the Device Administration license.

Only one license is required per deployment (regardless of multiple nodes).

Evaluation

Temporary (90 days)

Full Cisco ISE functionality is provided for 100 endpoints.

All Cisco ISE appliances are supplied with an Evaluation license.

Traditional License Consumption

You purchase licenses for the number of concurrent users on the system with Traditional Licensing. A Cisco ISE user consumes a license during an active session (always a Base; and a Plus and an Apex license, if you use the functionality covered by these licenses). Once the session ends, the license is released for reuse by other users.

Restriction

Cisco ISE license architecture consumption logic relies on authorization policy constructs. Cisco ISE uses the dictionaries and attributes within authorization rules to determine the license to use.

The Cisco ISE license is counted as follows:

A Base license is consumed for every active session. The same endpoint also consumes Plus and Apex licenses depending on the features that it is using.

Note

TACACS+ sessions do not consume a base license, but RADIUS sessions consume a base license.

The endpoint consumes the Base license before it consumes a Plus and Apex license.
The endpoint consumes the Plus license before it consumes an Apex license.
One Plus license is consumed per endpoint for any assortment of the license's features. Likewise, one Apex license is consumed per endpoint for any assortment of its features.
Licenses are counted against concurrent, active sessions.
Licenses are released for all features when the endpoint's session ends.
pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide.
One AnyConnect Apex user license is consumed by each user who uses AnyConnect regardless of the number of devices that the user owns and whether or not the user has an active connection to the network.
You can enable the TACACS+ service by adding a Device Administration license on top of an existing Base or Mobility license. This feature does not consume licenses.

To avoid service disruption, Cisco ISE continues to provide services to endpoints that exceed license entitlement. Cisco ISE instead relies on RADIUS accounting functions to track concurrent endpoints on the network and generates an alarm when the endpoint count of the previous day exceeded the amount of licenses.

View License Consumption

You can view your system's current license consumption from the Licensing dashboard at: Administration > System > Licensing. Consumption is portrayed as in the following image:

Figure 5. Traditional License Consumption

The License Consumption graph, in the License Usage area, is updated every 30 minutes. This window also displays the type of licenses purchased, the total number of concurrent users permitted on the system, and the expiry date of subscription services.

If you want to see your system's license consumption over multiple weeks, click Usage Over Time. Each bar in the graph shows the maximum number of licenses used during a period of one week.

Unregistered License Consumption

Problem

License consumption relies on the attributes used in the authorization policy with which the endpoint is matched.

Consider you only have a Base license registered on your system (you deleted the 90-day Evaluation license). You will be able to see and configure the corresponding Base menu items and features.

If you configure (mis-configure) an authorization policy to use a feature (for example: Session:PostureStatus) that requires an Apex license, and if an endpoint matches this authorization policy then:

The endpoint will consume an Apex license, despite the fact that an Apex license has not been registered on the system.
Notifications to this effect will appear whenever you log in.
Cisco ISE will give notifications and alarms "Exceeded license usage than allowed" (technically, this is to be expected as there are no registered Apex licenses on the system, but an endpoint is never-the-less consuming one).

Possible Causes

Due to authorization policy mis-configuration, the Licensing dashboard can show that Cisco ISE is consuming a license you have not purchased and registered. Before you purchase Plus and Apex licenses, the ISE user interface does not display the functionality covered by those licenses. However, once you have purchased these licenses, the user interface continues to display their functionality even after the license has expired or exceeded its endpoint consumption. Thus, you are able to configure them even if you do not have a valid license for them.

Solution

Choose Policy > Authorization, identify the authorization rule that is using the feature(s) for which you do not have a registered license, and reconfigure that rule.

Manage License Files

This section explains how to register, re-host, renew, migrate, upgrade, and remove ISE licenses:

Register Licenses
Re-Host Licenses
Renew Licenses
Migrate and Upgrade Licenses
Remove Licenses

Register Licenses

Before you begin

Consult your Cisco partner/account team about the types of licenses and number of concurrent users you require for your installation, together with the various packages you can purchase to maximize economy.

Procedure

Step 1	From the ordering system (Cisco Commerce Workspace - CCW) on Cisco's website www.cisco.com, order the required licenses. After about an hour, an email confirmation containing the Product Authorization Key (PAK) is sent.
Step 2	From the Cisco ISE Administration portal, choose AdministrationSystemLicensing. Make a note of the node information in the Licensing Details section: Product Identifier (PID), Version Identifier (VID), and Serial Number (SN).
Step 3	Go to www.cisco.com/go/licensing, and where prompted, enter the PAK of the license you received, the node information, and some details about your company. After one day, Cisco sends you the license file.
Step 4	Save this license file to a known location on your system.
Step 5	From the Cisco ISE Administration portal, choose Administration > System > Licensing. In the License Files section, click the Import License button.
Step 6	Click Choose File and select the license file you previously stored on your system.
Step 7	Click Import.

The new license is now installed on your system.

What to do next

Choose the licensing dashboard, Administration > System > Licensing, and verify that the newly-entered license appears with the correct details.

Re-Host Licenses

Re-hosting means moving a license from one Cisco ISE node to another. From the licensing portal, you select the PAK of the license you want to move and follow the instructions for re-hosting. After one day, you are sent an email with a new PAK. You then register this new PAK for the new node, and remove the old license from the original Cisco ISE node.

Renew Licenses

Subscription licenses, such as Plus and Apex licenses, are issued for 1, 3 or 5 years. Cisco ISE sends an alarm when licenses are near their expiration date and again when the licenses expire.

Licenses must be renewed after they expire. This process is carried out by your Cisco partner or account team only.

Migrate and Upgrade Licenses

Cisco licensing policy supports migration from previous Cisco ISE versions, upgrading from wireless and VPN only to include wired deployments, and adding concurrent users and functionality. You can also purchase bundles of licenses to minimize your ongoing expenses. These scenarios are all covered in the licensing site, or for more information contact your Cisco partner/account team.

Note

If you have migrated from Cisco ISE version 1.2, your Advanced license covers all the features in both Plus and Apex licenses.

Note

After upgrading from Cisco ISE version 1.3 or 1.4, the system will show the default Evaluation license only if it existed on the system prior to upgrade.

Note

Mobility/Mobility Upgrade license is always displayed as Base/Plus/Apex in the user interface with its corresponding number of end points.

If your Cisco ISE node needs to support:

A larger number of concurrent users than the number for which you have licenses
Wired (LAN) access, and your system has only the Mobility license

You will need to upgrade your license(s) for that node. This process is carried out by your Cisco partner or account team only.

Remove Licenses

Before you begin

Keep the following in mind before attempting to remove a license:

If you have installed a Mobility Upgrade license after a Mobility license, you must remove the Mobility Upgrade license before you can remove the underlying Mobility license.
If you install a combined license, all related installations in the Base, Plus, and Apex packages are also removed.

Procedure

Step 1	Choose Administration > System > Licensing
Step 2	In the License Files section, click the check next to the relevant file name, and click Delete License.
Step 3	Click OK.

Cisco Identity Services Engine Administrator Guide, Release 2.1

Book Title

Chapter Title

Results

Chapter: Cisco ISE Licenses

Cisco ISE Licenses