Licensing

Cisco ISE Licenses

Cisco ISE licensing offers two options to manage your licenses:

  • Smart Licensing—Monitor ISE software licenses and endpoint license consumption easily and efficiently with a single token registration. The licenses that you have purchased are maintained in a centralized database called the Cisco Smart Software Manager (CSSM). For more information about Smart Licensing, seeCisco ISE Smart LicensingCisco ISE Smart Licensing.

  • Traditional Licensing—Purchase and import individual licenses based on your needs and manage the application features and access, such as the number of concurrent endpoints that can use Cisco ISE network resources. For more information about Traditional Licensing, see Manage Traditional License Files.

To maximize economy for customers, licensing in Cisco ISE is supplied in different packages as Base, Plus, Apex, and Device Administration for both Traditional and Smart Licensing options. For more information about the Traditional Cisco licensing model, see Cisco ISE Licensing Model.

Once you have installed or upgraded your ISE box, Traditional Licensing is in use by default, and all license components are activated for a 90-day trial period. Once you switch to Smart Licensing, and before you register your token, this evaluation period remains active for the Smart Licensing, and the evaluation period includes all ISE licenses as part of that evaluation period. During the evaluation period, consumption is not reported to the CSSM.

You should update your installed licenses (for Traditional licensing) or license agreements (for Smart licensing) if:

  • The trial period ends and you have not yet installed or registered your license.

  • Your license has expired.

  • If endpoint consumption exceeds your licensing agreement.

ISE will notify you of license expiration or consumption problems 90, 60 and 30 days in advance. You can view and track licensing details from the License Warning icon at the top of the screen.

When upgrading from one licensing package to another more complex package, Cisco ISE will continue to offer all features that were available in the earlier package prior to upgrade and you will not need to re-configure any settings that you had already configured.

ISE Community Resource

Cisco Identity Services Engine Ordering Guide

For information on how to obtain evaluation licenses, see How to Get ISE Evaluation Licenses.

Cisco ISE Smart Licensing

Cisco offers Smart Licensing, which enables you to monitor Cisco ISE software licenses and endpoint license consumption easily and efficiently with a single token registration, rather than individually importing separate licenses. Details of all Cisco products and licenses that you have purchased are maintained in a centralized database, called the Cisco Smart Software Manager (CSSM), where you can easily track which endpoint licenses are available to you, and consumption statistics.

When a smart license token is activated and registered from ISE, it monitors consumption of licenses by each endpoint session per product license. Smart Licensing notifies the administrator about license consumption by endpoint sessions from a simple table layout in ISE. Smart Licensing reports the peak usage of each enabled license to the centralized database daily. When licenses are available and not consumed, the administrator is notified of available licenses and can continue to monitor usage. When consumption exceeds the amount of licenses available, an alarm is activated and the administrator is notified through alarms and notifications.

With Smart Licensing, you can also manage the different license entitlements included through your Cisco Smart Account, such as Base, Plus, Apex, or TACACS. From Cisco ISE, you can monitor basic consumption statistics per license entitlement. From your CSSM account, you can also view additional information, statistics and notifications, as well as make changes to your account and entitlements.


Note

Cisco Smart Software Manager satellite is not supported.


Cisco ISE takes internal samples of license consumption every 30 minutes, and compliancy and consumption is updated accordingly. To view this information in the Licenses table in Cisco ISE, click Refresh. At 1:00 a.m. every day, Cisco ISE reports peak counts daily to the CSSM server (the centralized database) based on the Yesterday's Peak Count data that is also displayed in the Licenses table, for each enabled license. Cisco ISE communicates with the CSSM server by storing a local copy of the CSSM certificate, which is automatically re-authorized during the daily synchronization, and also when the user manually refreshes the Licenses table. Typically, certificates are valid for six months. If compliancy changes when synchronized with the CSSM server, the Last Authorization column of the Licenses table updates accordingly. In addition, when entitlements are no longer compliant, the number of days for which they are out of compliancy appears in the Days Out of Compliancy column. Non-compliancy is also indicated in Notifications at the top of the Licensing area, and on the Cisco ISE toolbar at the License Warning link. In addition to notifications, you can view alarms.


Note

TACACS licenses are authorized when Cisco ISE communicates with the CSSM server, but they are not session-based and therefore no consumption count is associated with them in the Licenses table.


The compliance column of the Licenses table displays one of the following values:

  • In Compliance: The use of this license is in compliance.

  • Released Entitlement: The licenses have been purchased and released for use, but none have been consumed so far in this Cisco ISE deployment. In the case, you will see that the Consumption Count for the license is 0.

  • Evaluation: Evaluation licenses are available for use.

Figure 1. Licenses Table

Activate and Register Smart Licensing in ISE

Before you begin

Activate Smart Licensing and then register from Cisco ISE using the token issued to you by your Cisco representative through your CSSM account.

Ensure you have the necessary ISE permissions in your Cisco Smart Software Manager (CSSM) account. For more information, see https://software.cisco.com/ or contact your Cisco representative.

If you are upgrading from ISE-PIC, then prior to activating Smart Licensing with this procedure, you must first install the ISE Upgrade license and then:

  • Install the ISE Base license.

  • Or, move your PIC installation to an existing ISE deployment:

    1. From the existing ISE deployment, add another ISE node.

    2. Enable session profiling and pxGrid services from an existing ISE Administration node.


    Note

    For more information about adding and configuring more ISE nodes, see the Configure a Cisco ISE Node section in Cisco ISE Admin Guide: Deployment .

Procedure


Step 1

Choose Administration > System > Licensing to access the Licensing area of ISE.

After you install or upgrade Cisco ISE, traditional licensing is in use by default. The licensing mode appears at the top of the screen in the Licensing Method area of ISE:
Figure 2. Traditional Licensing
Step 2

Click the Cisco Smart Licensing link from the Licensing Method area to switch to Smart Licensing.

The Cisco Smart Licensing area expands with connection method fields.
Figure 3. Smart Licensing Connection Method Details
Step 3

From the Cisco Smart Licensing area, in the Secondary UDI field, if at least one additional ISE box is configured in your network, enter the secondary node you to be used if the Primary node is not available. Select a connection method by which to connect from your ISE box to the CSSM from the Connection Method dropdown list and click Enable. For Connection Method, choose:

  1. Direct HTTPS if you have a direct connection configured to reach the Internet.

  2. HTTPS Proxy if you do not have a direct connection and need to connect by proxy.

  3. Transport Gateway is the recommended connection method.

    When you use Smart Licensing, Smart Call Home (SCH) services are automatically activated as well, enabling you to configure a Transport Gateway. To configure Transport Gateway as your connection method, first configure it from the Smart Call Home settings in the Administration work center. To do this, and for additional information about SCH and Transport Gateway, see the Smart Call Home section in Cisco ISE Admin Guide: Troubleshooting .

Note 

After activating Smart Licensing, you have a 90-day evaluation period. During this time, all licenses are active. During this time, you can explore Smart Licensing and all the Cisco ISE features. If you don't register Smart Licensing with a valid token before the evaluation period expires, you cannot use Cisco ISE.

The fields in this area are dynamic. After you enter the connection details and click Enable, the area collapses. When you expand the area again, is now called Cisco Smart Licensing Registration, and you can enter smart licensing token details.

Step 4

From the Cisco Smart Licensing Registration area in ISE, enter the Registration Token you received when you purchased the smart licensing token, and click Register. To retrieve the token at any time, go to the ISE area of your CSSM account and click Copy.

You can disable any of the licenses in your smart licensing token by removing the checkmarks. When you disable the licenses, Smart Licensing no longer automatically validates those licenses.


Manage Smart Licensing in ISE

Once you have activated and registered your Smart Licensing token, you can manage license entitlements from ISE by:

  • Enabling, disabling and refreshing license entitlement certificates.

  • Updating Smart Licensing registration.

  • Identifying compliant and non-compliant licensing issues.

Before you begin

Ensure you have activated and registered your Smart Licensing token. For more information, see Activate and Register Smart Licensing in ISE.

Procedure


Step 1

When you first activate Smart Licensing, all license entitlements are enabled automatically as part of the evaluation period. Once you register your token, if your CSSM account does not include certain entitlements and you did not disable them during registration, non-compliant notifications will appear in ISE. Add those entitlements to your CSSM account (contact your CSSM account representative for assistance), and then from the Licenses table, click Refresh to remove non-compliant notifications and continue to use the related features. Once you have refreshed authorization, log out and then log back in to ISE for the relevant non-compliancy messages to be removed.

Step 2

If the daily automatic authorization does not succeed for any reason, non-compliancy messages may appear. Click Refresh to re-authorize your entitlements. Once you have refreshed authorization, log out and then log back in to ISE for the relevant non-compliancy messages to be removed.

Step 3

When you first activate Smart Licensing, all license entitlements are enabled automatically as part of the evaluation period. Once you register your token, if your CSSM account does not include certain entitlements and you did not disable them during registration, you can still disable those entitlements from Smart Licensing in ISE in order to avoid unnecessary non-compliant notifications. From the Licenses table, checkmark the license entitlements that are not included in your token, and click Disable from the toolbar. Once you have disabled license entitlements, log out and then log back in to ISE for the relevant features to be removed from the menus and for the non-compliancy messages to be removed.

Step 4

Once you add entitlements to your account, enable those entitlements. From the Licenses table, checkmark the required disabled licenses and click Enable from the toolbar.

Step 5

If you initially set-up Smart Licensing with only one UDI and do not enter a Secondary UDI, you can later update your information. Click the Cisco Smart Licensing Registration Details link to open the area. Re-enter the token, enter the new Secondary UDI and click Update.

Step 6

The registration certificate is automatically refreshed every six months. To manually refresh your Smart Licensing certificate registration, click Renew Registration from the top of the Cisco Smart Licensing area.

Step 7

To remove your ISE box registration (indicated by UDIs) from your Smart Account but continue to use Smart Licensing to the end of the evaluation period, click Deregister from the top of the Cisco Smart Licensing area. You can do this, for example, if you need to change the UDIs you have indicated as part of the registration process. If you still have time remaining in your evaluation period, ISE remains in Smart Licensing. If you have no time remaining in your evaluation period, a notification appears when the browser refreshes. Once you deregister, you can follow the registration process again in order to register with the same or different UDIs. For more information about activating and registering your Smart Licensing, see Activate and Register Smart Licensing in ISE.

Step 8

To remove your ISE box registration (indicated by UDIs) from your Smart Account entirely and to revert to traditional licensing, click Disable from the top of the Cisco Smart Licensing area. You can do this, for example, if you need to change the UDIs you have indicated as part of the registration process. Once you disable, you can follow the registration process again in order to activate and register with the same or different UDIs. For more information about activating and registering your Smart Licensing, see Activate and Register Smart Licensing in ISE.


Manage Traditional License Files

To continue to use Cisco ISE services after the 90-day Evaluation license expires, and to support more than 100 concurrent endpoints on the network, you must obtain and register Base licenses for the number of concurrent users on your system. If you require additional functionality, you will need Plus and/or Apex licenses to enable that functionality.

Licenses are uploaded to the Primary Policy Administration Node and propagated to the other Cisco ISE nodes in the cluster. Licenses are centrally managed by the Administration node, the other nodes do not require separate licenses. If you have two Administration nodes deployed in a high-availability pair, you must ensure that each of them have the same license capabilities. Generate the license with both the UDIs of the Primary and the Secondary Policy Administration Nodes and then add the license to the Primary Policy Administration Node.

After you install the Cisco ISE software and initially configure the appliance as the PAN, you must obtain a license for Cisco ISE and then register that license. You register all licenses to the PAN via the Primary and Secondary Administration Node hardware UDI. The PAN then centrally manages all the licenses that are registered for your deployment.


Note

When a node is deregistered from the PAN, it becomes a standalone node and its license is reset to Evaluation.


This section explains how to register, re-host, renew, migrate, upgrade, and remove Traditional ISE licenses.

Cisco ISE Licensing Model

Cisco ISE licensing model allows you to purchase licenses based on your enterprise's needs. When using Traditional Licensing, you import all individual licenses and continue to manage them individually from ISE. When using Smart Licensing, you manage a centralized Cisco account, which contains all information about the different endpoint licenses you have purchased.

Valid license options include:

  • ISE Base only

  • ISE Base and Plus

  • ISE Base and Apex

  • ISE Base and Device Administration

  • ISE Base, Plus, Apex, and Device Administration

  • ISE Base, Plus, Apex and AnyConnect Apex

Device Administration Licenses

There are two types of device administration licenses: cluster and node. A cluster license allows you to use device administration on all policy service nodes in a Cisco ISE cluster. A node license allows you to use device administration on a single policy service node. In a high-availability standalone deployment, a node license permits you to use device administration on a single node in the high availability pair.

The device administration license key is registered against the primary and secondary policy administration nodes. All policy service nodes in the cluster consume device administration licenses, as required, until the license count is reached.

Cluster licenses were introduced with the release of device administration in Cisco ISE 2.0, and is enforced in Cisco ISE 2.0 and later releases. Node licenses were released later, and are only partially enforced in releases 2.0 to 2.3. Starting with Cisco ISE 2.4, node licenses are completely enforced on a per-node basis.

Cluster licenses have been discontinued, and now only node Licenses are available for sale.

However, if you are upgrading to this release with a valid cluster license, you can continue to use your existing license upon upgrade.

The number of Plus license sessions can be up to the number of Base license sessions on the deployment. The same stands for Apex license sessions. Apex and Plus licenses can be installed independently without any restriction on the number of Apex versus Plus licenses. Cisco ISE licenses are based on the number of concurrent endpoints with active network connections whereas AnyConnect Apex licenses are on a per user basis. AnyConnect Apex license count can exceed Cisco ISE Base license count.


Note

The services contained within the Plus license, most notably profiling, are frequently used across the entire deployment. When you add Plus licenses to the deployment, we recommend that the Plus license count be equal to the Base license count. However, you might have a situation where the Plus license services might not be needed across the entire deployment, which is why Cisco ISE allows the Plus license count to be less than the Base license count.


Cisco recommends installing (for Traditional Licensing), or purchasing (for Smart Licensing) Base, Plus, and Apex licenses at the same time.

  • Base licenses are required to use the services enabled by Plus and/or Apex licenses. However, you do not need a Plus license in order to have an Apex license or vice versa, since there is no overlap in their functionality.

  • If the Plus and Apex licenses are not compliant, you cannot configure or edit Plus and Apex features. These features are displayed in read-only mode.

  • When you install a Base or Mobility Upgrade license, Cisco ISE continues to use the default Evaluation license as a separate license for the remainder of its duration.

  • When you install a Mobility Upgrade license, Cisco ISE enables all Wired, Wireless, and VPN services.

  • A Base or Mobility license is required to install the Device Administration license.

  • You cannot upgrade the Evaluation license to a Plus license without first installing the Base license.

Licenses for VM nodes

Cisco ISE is also sold as a virtual appliance. For Release 2.4, it is recommended that you install appropriate VM licenses for the VM nodes in your deployment. You must install the VM licenses based on the number of VM nodes and each VM node's resources such as CPU and memory. Otherwise, you will receive warnings and notifications to procure and install the VM license keys in Release 2.4, however, the services are not interrupted.

VM licenses are offered under three categories—Small, Medium and Large. For instance, if you are using 3595 equivalent VM node with 8 cores and 64 GB RAM, you might need a Medium category VM license, if you want to replicate the same capabilities on the VM. You can install multiple VM licenses based on the number of VMs and their resources as per your deployment requirements.

VM licenses are Infrastructure licenses, therefore, you can install VM licenses irrespective of the endpoint licenses available in your deployment. You can install a VM license even if you have not installed any Evaluation, Base, Plus, or Apex license in your deployment. However, in order to use the features enabled by the Base, Plus, or Apex licenses, you must install the appropriate licenses.

After installing or upgrading to Release 2.4, if there is any mismatch between the number of deployed VM nodes and installed VM licenses, alarms are displayed in the Alarms dashlet for every 14 days. Alarms are also displayed if there are any changes in the VM node’s resources or whenever a VM node is registered or deregistered.

VM licenses are perpetual licenses. VM licensing changes are displayed every time you log in to the Cisco ISE GUI, until you check the "Do not show this message again" check box in the notification popup.

If you have not purchased any ISE VM license before, refer to the ISE Ordering Guide to choose the appropriate VM license to be purchased. If you have purchased ISE VM licenses with no Product Authorization Key (PAK) associated, you can request VM PAKs by reaching out to licensing@cisco.com with Sales Order numbers that reflect the ISE VM purchase. This request will be processed to provide one medium VM license key for each ISE VM purchase you made in the past.

The following table shows the minimum VM resources by category:

VM Category

RAM Range

Number of CPUs

Small

16 GB

12 CPUs

Medium

64GB

16 CPUs

Large

256GB

16 CPUs

Table 1. Cisco ISE License Packages

ISE License Packages

Perpetual/Subscription (Terms Available)

ISE Functionality Covered

Notes

Base

Perpetual

  • Basic network access (AAA, IEEE-802.1X)

  • Guest services

  • Link encryption (MACSec)

  • TrustSec

  • ISE Application Programming Interfaces

Passive identity services available as part of the upgrade from ISE-PIC to a Base license include limited pxGrid features available to Cisco subscribers only.

Plus

Subscription (1, 3, or 5 years)

  • Bring Your Own Device (BYOD)—when consuming either a built-in or an external certificate authority

  • MSE integration for location services

  • Profiling and Feed Services

  • Adaptive Network Control (ANC)

  • Cisco pxGrid

Does not include Base services; a Base license is required to install the Plus license.

When onboarding an endpoint with the BYOD flow, the Plus services are consumed on the active session even when related BYOD attributes are not in use.

Plus licenses are supposed to be consumed when profiling-related authorization policies contain IdentityGroup:Name.

Apex

Subscription (1, 3, or 5 years)

  • Third Party Mobile Device Management (MDM) integration

  • Posture Compliance

  • TC NAC

Does not include Base services; a Base license is required to install the Apex license.

Note 

When you use Cisco AnyConnect as unified posture agent across wired, wireless, and VPN deployments, you need Cisco AnyConnect Apex user licenses in addition to Cisco ISE Apex licenses.

Mobility

Subscription (1, 3, or 5 years)

Combination of Base, Plus, and Apex for wireless and VPN endpoints

Cannot coexist on a Cisco Administration node with Base, Plus, and/or Apex licenses.

Mobility Upgrade

Subscription (1, 3, or 5 years)

Provides wired support to Mobility license

You can only install a Mobility Upgrade license on top of an existing Mobility license.

Device Administration

Perpetual

TACACS+

A Base or Mobility license is required to install the Device Administration license.

The number of Device Administration licenses must be equal to the number of Policy Service Nodes with TACACS+ persona enabled on them.

ISE-PIC

Perpetual

Passive identity services

One license per node. Each license supports up to 3,000 parallel sessions.

ISE-PIC upgrade

Perpetual

This license allows these options:

  • Enable additional (up to 300,000) parallel sessions.

  • Upgrade to full ISE instance

One license per node. Each license supports up to 300,000 parallel sessions.

After installing this license, the upgraded node can join an existing ISE deployment or alternatively, base licenses can be installed on the node to function as the PAN.

Passive identity services available as part of the upgrade to a Base license include limited pxGrid features available to Cisco subscribers only.

Evaluation

Temporary (90 days)

Full Cisco ISE functionality is provided for 100 endpoints.

All Cisco ISE appliances are supplied with an Evaluation license.

Traditional License Consumption

You purchase licenses for the number of concurrent users on the system with Traditional Licensing. A Cisco ISE user consumes a license during an active session (always a Base; and a Plus and an Apex license, if you use the functionality covered by these licenses). Once the session ends, the license is released for reuse by other users.


Restriction

Cisco ISE license architecture consumption logic relies on authorization policy constructs. Cisco ISE uses the dictionaries and attributes within authorization rules to determine the license to use.

The Cisco ISE license is counted as follows:

  • A Base license is consumed for every active session. The same endpoint also consumes Plus and Apex licenses depending on the features that it is using.


    Note

    TACACS+ sessions do not consume a base license, but RADIUS sessions consume a base license.


  • The endpoint consumes the Base license before it consumes a Plus and Apex license.

  • The endpoint consumes the Plus license before it consumes an Apex license.

  • One Plus license is consumed per endpoint for any assortment of the license's features. Likewise, one Apex license is consumed per endpoint for any assortment of its features.

  • Licenses are counted against concurrent, active sessions.

  • Licenses are released for all features when the endpoint's session ends.

  • pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide.

  • One AnyConnect Apex user license is consumed by each user who uses AnyConnect regardless of the number of devices that the user owns and whether or not the user has an active connection to the network.

  • You can enable the TACACS+ service by adding a Device Administration license on top of an existing Base or Mobility license.

To avoid service disruption, Cisco ISE continues to provide services to endpoints that exceed license entitlement. Cisco ISE instead relies on RADIUS accounting functions to track concurrent endpoints on the network and generates an alarm when the endpoint count of the previous day exceeded the amount of licenses. You can view license consumption clearly from the License Usage area in the Licensing screen, where licenses that are consumed beyond the permitted quantity appear in red in the line graph.

In addition, you can view and track detailed information per license package from the License Warning icon at the top of the screen.

View License Consumption

You can view your system's current license consumption from the Licensing dashboard at: Administration > System > Licensing. Consumption is portrayed as in the following image:
Figure 4. Traditional License Consumption

The License Consumption graph, in the License Usage area, is updated every 30 minutes. This window also displays the type of licenses purchased, the total number of concurrent users permitted on the system, and the expiry date of subscription services.

If you want to see your system's license consumption over multiple weeks, click Usage Over Time. Each bar in the graph shows the maximum number of licenses used during a period of one week.

Unregistered License Consumption

Problem

License consumption relies on the attributes used in the authorization policy with which the endpoint is matched.

Consider you only have a Base license registered on your system (you deleted the 90-day Evaluation license). You will be able to see and configure the corresponding Base menu items and features.

If you configure (mis-configure) an authorization policy to use a feature (for example: Session:PostureStatus) that requires an Apex license, and if an endpoint matches this authorization policy then:

  • The endpoint will consume an Apex license, despite the fact that an Apex license has not been registered on the system.

  • Notifications to this effect will appear whenever you log in.

  • Cisco ISE will give notifications and alarms "Exceeded license usage than allowed" (technically, this is to be expected as there are no registered Apex licenses on the system, but an endpoint is never-the-less consuming one).

When Cisco ISE Base, Apex, or Plus licenses are used out of compliance, the administrator will receive alerts on the Cisco ISE GUI stating that they will have limited access to Cisco ISE after a set number of days. If the licenses continue to be used out of compliance after the said number of days, all administrative control of Cisco ISE will be lost until the correct license files are uploaded. However, Cisco ISE will continue to handle authentications.

Possible Causes

Due to authorization policy mis-configuration, the Licensing dashboard can show that Cisco ISE is consuming a license you have not purchased and registered. Before you purchase Plus and Apex licenses, the ISE user interface does not display the functionality covered by those licenses. However, once you have purchased these licenses, the user interface continues to display their functionality even after the license has expired or exceeded its endpoint consumption. Thus, you are able to configure them even if you do not have a valid license for them.

Solution

Choose Policy > Policy Sets, identify the authorization rule that is using the feature(s) for which you do not have a registered license, and reconfigure that rule.

Manage License Files

This section explains how to register, re-host, renew, migrate, upgrade, and remove ISE licenses:

Register Licenses

Before you begin

Consult your Cisco partner/account team about the types of licenses and number of concurrent users you require for your installation, together with the various packages you can purchase to maximize economy.

Procedure

Step 1

From the ordering system (Cisco Commerce Workspace - CCW) on Cisco's website www.cisco.com, order the required licenses.

After about an hour, an email confirmation containing the Product Authorization Key (PAK) is sent.

Step 2

From the Cisco ISE Administration portal, choose AdministrationSystemLicensing. Make a note of the node information in the Licensing Details section: Product Identifier (PID), Version Identifier (VID), and Serial Number (SN).

Step 3

Go to www.cisco.com/go/licensing, and where prompted, enter the PAK of the license you received, the node information, and some details about your company.

The PAK number can be obtained from the sticker located on the software's CD sleeve or on a License Claim Certificate that was physically mailed to you. Post license registration, the permanent license will be sent to your provided email address. Licenses are sent from licensing@cisco.com, add this address to your safe senders list to receive emails from this mailer.

Step 4

Save this license file to a known location on your system.

Step 5

From the Cisco ISE Administration portal, choose Administration > System > Licensing. In the License Files section, click the Import License button.

Step 6

Click Choose File and select the license file you previously stored on your system.

Step 7

Click Import.


The new license is now installed on your system.
What to do next

Choose the licensing dashboard, Administration > System > Licensing, and verify that the newly-entered license appears with the correct details.

Re-Host Licenses

Re-hosting means moving a license from one Cisco ISE node to another. From the licensing portal, you select the PAK of the license you want to move and follow the instructions for re-hosting. After one day, you are sent an email with a new PAK. You then register this new PAK for the new node, and remove the old license from the original Cisco ISE node.

Renew Licenses

Subscription licenses, such as Plus and Apex licenses, are issued for 1, 3 or 5 years. Cisco ISE sends an alarm when licenses are near their expiration date and again when the licenses expire.

Licenses must be renewed after they expire. This process is carried out by your Cisco partner or account team only.

Migrate and Upgrade Licenses

Cisco licensing policy supports migration from previous Cisco ISE versions, upgrading from wireless and VPN only to include wired deployments, and adding concurrent users and functionality. You can also purchase bundles of licenses to minimize your ongoing expenses. These scenarios are all covered in the licensing site, or for more information contact your Cisco partner/account team.


Note

If you have migrated from Cisco ISE version 1.2, your Advanced license covers all the features in both Plus and Apex licenses.

Note

After upgrading from Cisco ISE version 1.3 or 1.4, the system will show the default Evaluation license only if it existed on the system prior to upgrade.

Note

Mobility/Mobility Upgrade license is always displayed as Base/Plus/Apex in the user interface with its corresponding number of end points.

If your Cisco ISE node needs to support:

  • A larger number of concurrent users than the number for which you have licenses

  • Wired (LAN) access, and your system has only the Mobility license

You will need to upgrade your license(s) for that node. This process is carried out by your Cisco partner or account team only.

Remove Licenses

Before you begin

Keep the following in mind before attempting to remove a license:

  • If you have installed a Mobility Upgrade license after a Mobility license, you must remove the Mobility Upgrade license before you can remove the underlying Mobility license.

  • If you install a combined license, all related installations in the Base, Plus, and Apex packages are also removed.

Procedure

Step 1

Choose Administration > System > Licensing

Step 2

In the License Files section, click the check next to the relevant file name, and click Delete License.

Step 3

Click OK.