ISE false licensing alarms

Hello,
I have an ISE 3315 with 250 base licenses and 250 advanced licenses. I have been receiving regular alarms (every two hours) stating the following...
"Base concurrent users exceed license allowable count"
However, the active device count is 202 and has never been above 206. The advanced is currently 57..
Service Installations License File License Expires EndPoints Updated Time Counter
Base Package 250 202/250
I cannot clear the alarms either.
Many thanks,
Dave

This is due to a known defect.
CSCtw73946 Invalid ISE License Enforcement Alarm
Symptom:
With correct Base and Advanced License already installed correctly - ISE generates alert;-
"Base concurrent users exceed license allowable count".
"Advanced concurrent users/endpoints exceed license allowable count"
Conditions:
This is not Service Affecting.
Workaround:
None
~BR
Jatin Katyal
**Do rate helpful posts**

Similar Messages

Cisco ISE - expired demo license alarm

Hi,
We are implementing Cisco ISE 1.2.0.899 and have an alarm reporting expired license. This alarm refers to the Advanced License demo and is therefore a false positive.
This issue is that we cannot remove the demo icense and stop the root cause of this false positive alarm.
Does anyone has an idea?
Thanks in advance.
Regards,
Telmo Oliveira

Please refer the discussion below
https://supportforums.cisco.com/discussion/12059041/ise-advanced-eval-license-alerts-after-full-base-install

ISE 3315 License needed for integration with PxGrid SealthWatch

Hello Experts,
i have ISE 3315 with Version 1.3
i want to integrate it with pxgrid and ordering Sealthwatch. Can anyone tell me do i need To have ISE Advance-License for this integration ? Or with ISE Base-License it can work?
Thanks

ISE License Packages
Perpetual/Subscription (Terms Available)
ISE Functionality Covered
Notes
Base
Perpetual
Basic network access: AAA, IEEE-802.1X
Guest management
Link encryption (MACSec)
TrustSec
ISE Application Programming Interfaces
Plus
Subscription (1, 3, or 5 years)
Bring Your Own Device (BYOD) with built-in Certificate Authority Services
Profiling and Feed Services
Endpoint Protection Service (EPS)
Cisco pxGrid
Does not include Base services; a Base license is required to install the Plus license.
Apex
Subscription (1, 3, or 5 years)
Third Party Mobile Device Management (MDM)
Posture Compliance
Does not include Base or Plus services; a Base license is required to install the Apex license.
Note
When you use Cisco AnyConnect as unified posture agent across wired, wireless, and VPN deployments, you need Cisco AnyConnect Apex user licenses in addition to Cisco ISE Apex licenses.
Mobility
Subscription (1, 3, or 5 years)
Combination of Base, Plus, and Apex for wireless and VPN endpoints
Cannot coexist on a Cisco Administration node with Base, Plus, and/or Apex Licenses.
Mobility Upgrade
Subscription (1, 3, or 5 years)
Provides wired support to Mobility license
You can only install a Mobility Upgrade License on top of an existing Mobility license.
Evaluation
Temporary (90 days)
Full Cisco ISE functionality is provided for 100 endpoints.
All Cisco ISE appliances are supplied with an Evaluation license.

ISE Advanced license details (how to?)

I'm currently checking an ise deployment recently migrated to production phase
in the license count it shows 1-3 advanced licenses used but none of the authorization policies use explicit conditions that make use of the profiling grouping (profiling enabled but not used in any authorization condition)
it is still showing (after 2 days) this 3 advanced license used... note that the test switches are still connected but no port is used....
is there a way to correlate this 3 consumed licences to the endpoint using it?
thank you very much for your help
Giuliano

Please disable the posturing and pforiling feature in ISE appliance. After this there is no chance to consume the advance license.

Can I use ISE demo license for wireless purposes???

Hi all.
We want to try an ISE deployment with one or two WLC and the license twe want to use initially is the demo embedded in the ISE appliance. We don't know whether we can do it because demo license covers base and advanced capabilities but not wireless (at least in administration/licensing this box shows "not installed" leyend) and we don't know whether a demo tape of wireless solution will work with this type of licensing; if not, is it possible to get a demo wireless license for ISE?
Thanks.
Best Regards.

The evaluation license does cover the wireless. Its actaully a full license.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

ISE-3315, license

Hi all,
I hope someone can help me out with the following question;
We want to buy a ISE-3315-K9 for 500 end-devices.
In the price-list I found the ISE-3315-K9 but cannot find the base license: L-ISE-BSE-500=. (I think I need this license)
Will the shipment of the ISE-3315-K9 includes a 3000 end-points base license (maximum support of the ISE-3315) or do I need to order the base 500 license seperately?
Thanks in advance,
Erik Verkerk.

Cisco ISE comes with a built-in evaluation license, which is valid for 90 days. The evaluation license includes both base and advanced packages and limits the number of endpoints to 100 for both the base and advanced packages
ISE 3315 is End-of-Sale
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11640/eol_C51-728424.html
For 500 endpoint support (basic funtionality ) you need to buy L-ISE-BSE-500=
https://apps.cisco.com/WOC/WOConfigUI/pages/configset/configset.jsp

ISE base license and import of enddevices

Hi,
Been going through the intire internet (or so it seems) and most guides and tips are about features that is included in the advanced license, profiling and so on.
I am facing a case where base license should be enough. But I am confused about the import of endpoints.
When using the base license is the only way to import devices manualy or through file or LDAP? Can't ISE scan the network an pick up MAC addresses automaticly?
We dont have LDAP and about 20 000 endpoints, so adding them manualy or to a csv-file is too much work.
Regards,
Philip

And another question about base license (I can guess the answer but some confirmation would be good)
When the user has registered a device through the My Devices Portal webpage the device will end up in RegisteredDevices Identity Group.
Is there anyway to change this? Is there a way for the user to choose what group the device should be in? Or is the only way to change ID group that an administrator of ISE do it manually?
The problem that we are facing are that some devices should go to VLAN X and other on VLAN Y. But since they all are assigned to the RegisteredDevices group there is no way to differentiate them in a authorization profile.
Regards
Philip
Edit: Just found out that this might be solved in 1.2. It will implement the use of Endpoint Profile as an attribute in authorization profiles.

Recurrent ISE M&T alarm

Hi support community
i have an ISE deployment with two 3315 appliances running ISE 1.1.1.268 with patch 5 installed. im receiving many alarms as shown in the attached image.
The alarmas are generated principaly during idle periods (for example in weekends or during night).
i dont know if that alarm is something to get worried or why is happening, any information about that would be greatly appreciated.
Many thanks in advance

Looks like watchdog having problems with DB.
Open up a TAC case, we need to get a bit more in depth.

ISE - Mass Delete Alarms

Anyway to do a single mass delete of alarms ?
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

I agree with Tarik. Unfortunately, it's not possible to delete all the alarms in one go. We have to delete page by page but It's very tedious when you have 7k alarms. A (sev 6) feature request has already been filed on this:
CSCtw76687    Option to purge all items in alarm inbox
Description:
ISE-Alpha has > 16K items in alarm inbox and it will take a long time to delete them page by page. We should implement an option to trash all items in one shot if so desired. The delete-all option should give the proper warnings that all items will be removed and not recoverable.
~BR
Jatin Katyal
**Do rate helpful posts**

ISE VMware Licensing

We are deploying ISE on a Cisco UCS platform.
We have obtained the folowing:
ISE-VM-K9=
Cisco Identity   Services EngineVirtual Machine Image
L-ISE-BSE-5K=
Cisco Identity   Services Engine
However do I need any additional VMware licensing such as:
R-VMW-UC-FND5-K9
Cisco UC Virt. Foundation 5.0   (2-Socket 32GB vRAM)
Regards
Stewart

Stewart,
As far as deploying the UCS you may need to reach out to the UCS team for this question. I think when you purchase the UCS that vmware licenses come with the box, however I do not know this for sure.
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE clustering & licensing

Hello Experts.
Could you help me to know, if we wan't to make a cluster from physical or virtual ISE servers, do we need to use separate licensing also?
I mean to we need to buy the same licenses for the secondary server, as it is on primary?

No you don’t need to buy additional licenses. The licenses that you apply on the primary servers will be applicable to all the ISE devices connected to the primary ISE device.
Please review the below link which might be helpful:
http://www.cisco.com/en/US/partner/prod/collateral/vpndevc/ps5712/ps11637/ps11195/guide_c07-656177.html
http://www.cisco.com/en/US/docs/security/ise/1.1.1/upgrade_guide/upgrade.html

ISE Secondary licensing

There used to be a facility to add the secondary ISE admin node to the licensing so that there weren't problems when the primary fell over.
I licensed a primary and secondary yesterday for base in this way. When I filled out the advanced license in the same way it failed and suggested I raise a TAC case.
TAC telling me that only the primary is licensed. Has this changed?
I did ask if this was only for advanced, but got the same answer back "ISE is only licensed on the primary".
Thanks.

If you have two Administration nodes deployed in a high-availability pair, you can obtain a license based on the hardware IDs of both the primary and secondary Administration nodes. After you obtain the license, add it only to the primary Administration node. The license gets replicated to the secondary Administration node.
Refer
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_license.html

ISE - Advanced License Usage

Can anyone provide some insight as to why I am utilizing advanced licensing features on my new ISE implementation? Please see attached screen shot for counts.
I'm not doing anything special, none of the features listed as 'advanced' in Cisco docs. Was thinking it's possibly a bug because it's the same count as I have for Base Package. Will custom profiling policies utilize advanced licensing?
Kind Regards,
Kevin
**Please remember to rate helpful posts as well as mark the question as 'answered' once your issue is resolved. This will help others to find your solution faster.

Kevin,
Venkatesh is correct, when using dynamic profiling in an authorization policy will consume and advanced endpoint license. Here is some documentation that will help:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html
With a base license installed, you cannot profile endpoints on your network. You can only manage endpoints including import and the static assignment of endpoints by using the Endpoints page, and viewing on the Endpoint Identity Groups page. For more details, see
Endpoints, page 4-14
, and
Endpoint Identity Groups, page 4-62
sections in
Chapter 4, "Managing Identities and Admin Access."
Tarik Admani
*Please rate helpful posts*

ISE SGT License

We are using 150 servers and using Security Groups and 1500 clients connecting to them, think I need advance licenses?, do I need to worry about licenses for the clients connecting to the servers? pls assist me on this

Every package is licensed based on the total number of concurrent endpoints that use the services in the package. The total number of endpoints includes all the endpoints connecting to the Cisco Identity Services Engine within a deployment. Every time an endpoint connects to the Cisco Identity Services Engine, it consumes one license from one or more packages (depending on what services it uses); when the endpoint disconnects from the network, it releases that license from the Cisco Identity Services Engine (after the Cisco Identity Services Engine receives a RADIUS stop message).
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/qa_c67-658591.html
Advanced
Capabilities: Profiler and feed service, posture, MDM integration*, automated endpoint onboarding, and Security Group Access (SGA)
Network deployment support: Wired, wireless, and VPN
License prerequisite: Base license
Term license: 3- and 5-year terms
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
~BR
Jatin Katyal
**Do rate helpful posts**

Cisco ISE Error, System Alarm (Colector)

Hi there,
Some Authentication erros won't show up on the Cisco ISE /Operations/Authentications Log.
There is an error on the database:
Details: Database failure (<ise-hostname>, RadiusAuthenticationFailed)
Exception:
ORA-01461: can bind a LONG value only for insert into a LONG column
Any ideas?
Thanks,
Norbert

Hi Jallaluddin
I work for Centrify Support and saw your posting. Here our analysis on checking the adlogs.txt.zip:
Server not found in Kerberos database" (reference base/adbind.cpp:495 rc: -1765328377)
That error is likely coming from the KDC - meaning there is some problem with server side SPNs
We need the following:
1) A network trace.
2) adcheck output.
3) adinfo --support output
4) Run dcdiag or netdiag on the server side.
Also we partner with Cisco and so would it possible to work with your partners and I am pretty sure they have seen this before with DC issues etc. Can you please work with them and see?. TIA
Best Regards
Raghu Srinivasan

ISE false licensing alarms

Similar Messages

Maybe you are looking for