ISE version 1.2 licensing question

I have the following scenarios:
iseA is the Primnary Admin/MNT/
iseB is the Secondary Admin/MNT
iseC is the PSN
iseD is the PSN
I use iseA serial number to get the license from Cisco licensing for base and advanced features,
Now iseA is dead and requires RMA.
I promoted iseB to be primary Admin/MNT, and de-register from iseA from the cluster,
I replaced iseA with a new appliance from Cisco and name it iseA with the same ISE 1.2 and put it back into the cluster. I plan on keeping iseB Primary Admin/MNT and iseA Secondary Admin/MNT
Question: What will happen to the license? Does it mean I have to go to Cisco licensing and re-register for the license again because the license for iseB is no longer valid?
Please help.

Not at all. You can go here: https://tools.cisco.com/SWIFT/LicensingUI/Quickstart and migrate the existing license to the new hardware. You have to log in with your Cisco ID, but it is a quick and painless process.
Using the wizard is probably the easiest way to do it, and you will have your new license file quickly.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Similar Messages

I am using a licensed CS3 Chinese Version and Illustrator shows question mark on the menu bar. iMac,

I am using a licensed CS3 Chinese Version and Illustrator shows question mark on the menu bar.
iMac, OS X Mountain Lion (10.8.2)

$$$/_MBAR/Mnu showing in Menu Bar - IllustratorHints
Mylenium

Cisco Identity Services Engine (ISE) Version 1.2: What's New in Features and Troubleshooting Options

With Ali Mohammed
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about what’s new in Cisco Identity Services Engine (ISE) Version 1.2 and to understand the new features and enhanced troubleshooting options with Cisco expert Ali Mohammed.
Cisco ISE can be deployed as an appliance or virtual machine to enforce security policy on all devices that attempt to gain access to network infrastructure. ISE 1.2 provides feature enrichment in terms of mobile device management, BYOD enhancements, and so on. It also performs noise suppression in log collection so customers have greater ability to store and analyze logs for a longer period.
Ali Mohammed is an escalation engineer with the Security Access and Mobility Product Group (SAMPG), providing support to all Cisco NAC and Cisco ISE installed base. Ali works on complicated recreations of customer issues and helps customers in resolving configuration, deployment, setup, and integration issues involving Cisco NAC and Cisco ISE products. Ali works on enhancing tools available in ISE/NAC that are required to help troubleshoot the product setup in customer environments. Ali has six and a half years of experience at Cisco and is CCIE certified in security (number 24130).
Remember to use the rating system to let Ali know if you have received an adequate response.
Because of the volume expected during this event, Ali might not be able to answer each question. Remember that you can continue the conversation on the Security community, sub-community shortly after the event. This event lasts through September 6, 2013. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Ali,
We currently have a two-node deployment running 1.1.3.124, as depicted in diagram:
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_010.html#ID89
Question 1:
After step 1 is done, node B becomes the new primary node.
What's the license impact at that stage, when the license is mainly tied to node A, the previous primary PAN?
Step 3 says to obtain a new license that's tied to both node A & node B, as if it's implying an issue would arise, if we leave node B as the primary PAN, instead of reverting back to node A.
=========
Question 2:
When step 1 is completed, node B runs 1.2, while node A runs 1.1.3.124.
Do both nodes still function as PSN nodes, and can service end users at that point? (before we proceed to step 2)
Both nodes are behind our ACE load balancer, and I'm trying to confirm the behavior during the upgrade, to determine when to take each node out of the load balancing serverfarm, to keep the service up and avoid an outage.
===========
Question 3:
According to the upgrade guide, we're supposed to perform a config backup from PAN & MnT nodes.
Is the config backup used only when we need to rollback from 1.2 to 1.1.3, or can it be used to restore config on 1.2?
It also says to record customizations & alert settings because after the upgrade to 1.2, these settings would change, and we would need to re-configure them.
Is this correct? That's a lot of screen shots we'll need to take; is there any way to avoid this?
It says: "
Disable services such as Guest, Profiler, Device Onboarding, and so on before upgrade and enable them after upgrade. Otherwise, you must add the guest users who are lost, and devices must be profiled and onboarded again."
Exactly how do you disable services? Disable all the authorization policies?
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html#reference_4EFE5E15B9854A648C9EF18D492B9105
==================
Question 4:
The 1.1 user guide says the maximum number of nodes in a node group was 4.
The 1.2 guide now says the maximum is 10.
Is there a hard limit on how many nodes can be in a node group?
We currently don't use node group, due to the lack of multicast support on the ACE-20.
Is it a big deal not to have one?
http://www.cisco.com/en/US/customer/docs/security/ise/1.2/user_guide/ise_dis_deploy.html#wp1230118
thanks,
Kevin

ISE version 1.2 patch 6 release notes

Hi Everyone,
I notice that Cisco has released patch 6 for ISE version 1.2 yesterday.
I am trying to locate the all the "resolved" issues for patch 6; However, when I look at the ISE release notes
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/release_notes/ise12_rn.html#wp407339
It only shows resolved issues up to patch 5.
Where can I find the list of "resolved" issues that comes with patch 6?
Thanks in advance.

Due to the high demand for patch 6, it was released prior to the release notes. The Release Notes will be updated within 24 hours.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE version 1.2 patch-5 backup schedules

Hi,
I have ISE version 1.2 patch 5 and I have scheduled a backup every day @3am EST.
Now I would like to delete that backup schedule. I know how to disable the backup but I would like to delete it completely. In other words, I do not want to see it everytime I log into the WebUI Administration --> backup & restore.
Is it possible?

At this time, you can only disable the scheduled backups, you cannot delete them. I know that enhancements to the sceduled backup are scheduled for 1.2.1 and hope that this is one of them.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Lumira Server for BI Platform and Team/Edge consumption & licensing question

Hi. I have a few questions.
Question 1:
From my reading, I've heard that Lumira Edge/Team server may not be a part of BI-Suite License. I read a Lumira Server ASUG Webcast recap by Tammy Powlas here (SAP Lumira Server for Teams Roadmap ASUG Webcast) over the weekend and one of the Q&A questions struck me:
Q: Is this included with the BI Suite license from SAP?
A: Lumira Server for Teams (Edge Edition) is not covered under BI Suite License. However, Lumira Server for BI Platform (RTC Planned in April) is covered under BI Suite licenses
In a separate conversation late 2014, I thought I'd heard that Lumira Team/Edge server was supposed to be usable by BI Suite licensed customers, but it sounds like I'm mistaken?
Question 2:
Next, the second part of the statement gave me hope:
However, Lumira Server for BI Platform (RTC Planned in April) is covered under BI Suite licenses
I then looked at the Lumira Deployment Options for Departments Part 1 – ASUG Webcast by Tammy Powlas to get some more information on Lumira Server for BI Platform. This slide gave me some hope (emphasis mine in green):
But then I see some more information a little later:
Is this slide to imply that the version without HANA (or HANA XS) for BI Platform will only really just serve as a user rights management and Lumira document repository? And that if I want to view a Lumira document, I must still open from the Lumira Desktop client?
It was suggested I start a new discussion thread to ask this licensing question about a product that's not out yet (but the slide says it's GA so I'm still confused) so here I am with my discussion thread!
Hopefully someone can make me less confused. I'm hoping the answer is as a BI-Suite customer that we do not have to make a decision to either invest in new Edge/Team licenses or buy HANA XS hardware to establish a beachhead of Lumira usage in our organization. We've been struggling with promoting Lumira and the sharing piece has been the sore spot.

Hi Michael
You are right, it is confusing...
I think it will be better to contact sales to get this explained as opposed to technical support people that monitor this SCN Space.
Sales ph: 866-681-3435, 1-800-677-7271
Worldwide Office Locations | SAP
- Ludek
Senior Support Engineer AGS Product Support, Global Support Center Canada
Follow me on Twitter (#SAPLumira)
Got Enhancement ideas? Use the SAP Idea Place

Does Cisco ISE-3315-K9 with ise version: Service Engine: 1.0.4.573 support command accouting like ACS

Hi
Can Anybody can update whether ISE-3315-K9 with ise version: Service Engine: 1.0.4.573 , supports the command level accounting
Bascially , we have integrated Cisco Switches with Cisco ISE for Device Authentication using Radius , we are able get the authentication logs on to the devices , but for any command changes or update done on Cisco devices we are not able to get the command accounting ..
has succeed in command level accounting on Cisco ISE ..
Please update
Cisco ISE doesn't have TACACS feature ...

Command Accounting is a TACACS+ feature so not for ISE....yet.
However, you can do the following to send commands to syslog and not including passwords (hidekeys). I just picked 200 commands/lines to store in the local command buffer/log. increase or decrease as you have memory. The notify syslog is what sends it via syslog.
conf t
archive
log config
logging enable
logging size 200
hidekeys
notify syslog
end
wr mem
Remember, syslog is clear text :-) log away from user traffic when possible. Or use TLS based syslog when possible.
I hope you find this answer useful, if it was satisfactory for you, please mark the question as Answered.
Please rate post you consider useful.
-James

Cisco ISE Version control via HTTPS

Hi there.
Is it possible to verify the ISE version by Web GUI? If yes. where can I find the version number`?'
BR.

At the bottom left corner there is a question mark with button "help", hover over it and then press "About Identity Services Engine".

Licensing question. Buying older components of OS X.

Licensing question. Buying older components of OS X.
My first question is where might I find an older version of imovie?
If you purchase OS 10.4 Tiger, are you entitled to download an earlier version of imovie such as imovie2, imovie 3 or imovie4 for no cost? Or must I also purchase iLife05 in order to instal any version of imovie? The reason I ask is that I remember that OS 10.1.5 use to have imovie included. Now imovie seems to be part of iLife which is a separate software package to purchase.
How and where might I find an earlier version of imovie? I ask this in terms of older computers that may run the older versions of imovie better than imovieHD.
Here is why I was asking:
I once spoke with someone at Apple who explained to me that if you purchase an OS from Apple, you are entitled to the software from earlier OSes. If I remember correctly, the example we were discussing was in terms of fonts. I must be certain to indicate that this is how I perceived the licensing issue and I could be incorrect in my understanding:
"If a user purchases an operating system from Apple, they are entitled to install any software from previous releases of the Operating system." For example, if a user purchases a second computer such as a portable computer, and then purchases mac os 10 for that computer, he or she may legally install any fonts that may have been bundled with any earlier Apple Operating Systems such as the fonts that came bundled with OS 8.5.
On Apple's web site is an area where one may download old software (old os systems) for free. These bundled fonts may be installed on as many computers as one would like because Apple offers them for free. You most likely would need to have purchased at least one of Apple's Operating Systems to be able to legally use the software from any earlier versions of your Operating System.
And so I would like to ask if this could be also considered in terms of OSX. If I buy Tiger, am I legally entitled to Panther on that same computer? This may be helpful for someone who would like to use Tiger as well as some older components of Panther. Maybe for some reason ical version 1.5 (in Panther) might be prefered over ical version 2.0 (in Tiger) due to some computer compatibility issue. Whether this is practical or not I am just outlining a theoretical example to help understand the specifics of Apple OS licensing.
And so I would like to ask this question in terms of imovie. How might I purchase an older version of imovie? May I purchase Tiger and then find an OEM version of Panther which I would then be legally entitled to install on that same computer? Or is there a place on the Apple website where users of Tiger are able to download older components from older OSX versions?
Or must I purchase the retail versions of both Tiger and Panther?
Thank you for any clarification,

Thank you Allan and Dakota for jumping into this issue.
Allan, you have been very helpful with your comments and I think you have answered the question which is "no" (unfortunately). To summarize then, if you purchase an OS, you are not entitled to the components of an earlier OS - unless Apple makes it available free on their website. For example, if you purchase Tiger, you are not entitled to any components of Panther or Jaguar - even the older imovie that came with 10.1.5. It would be nice if Apple jumped into the discussion here to confirm this, however I am sure that is what they would say. Unless I hear otherwise I will assume this is also Apple's stance - that if you purchase an OS 9 (or application), you are not entitled to the components of an earlier OS (or application).
Dakota raises a good point also. However, unfortunately I see a small legal technical flaw with Dakota's procedure. Apple licences software per computer rather than per user. (I believe Adobe's licencing policy is the other way around - which I prefer.) And so technically iMovie 3.0.3 is only licensed to the Powerbook and cannot legally be copied to the iMac even if the iMac is running the latest version of iLife (and Tiger). You see, that was one of the key issues in this original post.
Personally I wish Apple would lessen the restriction on this policy with a clause in the licencing agreement allowing use of some earlier versions of applications (or OS components) to be used - especially the iLife components such as iMovie or iPhoto.
Licencing per user rather than per computer seems to be a little more practical for users in terms of promoting people to adopt the digital lifestyle considering many people have a workstation at home and also carry a portable on the road - well a little less costly anyways for the user. It would be nice if we were able to legally copy certain components across devices but that doesn't seem to be the case today with Apple. Perhaps Apple's licencing policy could be a hybrid model and follow some aspects of Adobe's licencing model. Here's an idea: allow users to pay for a "sub" licence for older apps. Everyone would benefit. Apple would earn more income from us and we would legally be able to use more Apple software on more devices. Just a few thoughts to share.
Mike

ISE version 1.1.2 patch-5 or 1.1.3

I am about to deploy ISE in a new environment. My plan is to go with ISE 1.1.2 with patch-5 or with 1.1.3
My problem with 1.1.3 is that it is new and no patch. While there are new features in 1.1.3 but it also comes with unknown issues and bugs that will not be resolved until patch-1 in 1.1.3. Therefore, I plan on staying at 1.1.2 patch-5.
What do you think?

Hello David-
With any new products, such as ISE (version 1.x), I tend to always go with the latest release as there are constantly more and more bugs that are being fixed along with new features. I have one deployment running on 1.1.3 and I have not had/heard any issues.
Also, there is a nasty bug with 1.1.2 where if you use automatic backups your EAP-TLS authentications start to fail and can only be resolved by a reload. (CSCud00831). So if you are planning to use EAP-TLS type authentications then I would strongly recommend that you go with 1.1.3
Thank you for rating!

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is SMS notifications are supported for Guest self−registration

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is
SMS notifications are supported for Guest self−registration Services ? or it should be done by Sponsor

I'm not sure I understand the question. Do you want to log in to the Sponsor Portal using AD credentials?
Create an Identity Source Sequence using AD as an Authentication Source. Go to Administration > Identity Management > Identity Source Sequences. Either Edit or +Add a Sequence and choose from the Authentication Sources shown.
Then choose that Identity Source Sequence by going to Administration > Web Portal Management > Settings. Double-click Sponsor from the Left Menu and click Authentication Source. Choose the Identity Source Sequence. Click Save.
I hope this helps.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Instant Client SQL*Plus License Question

Can anyone shed some light on a license question for me? (I know that most license questions are for Oracle Sales to handle, but this involves a supposedly free product.)
I want to use SQL*Plus with the Instant Client in a production environment, but I am not sure whether I am entitled to. Does Instant Client "support" SQL*Plus only in the sense that if I already own a license for SQL*Plus I can use it with the Instant Client, or is the Instant Client SQL*Plus package also truly free to deploy and use?
The download page has links to download a basic Instant Client, plus several optional packages, one of which is SQL*Plus. However, the FAQ does not tell me whether the optional packages (specifically SQL*Plus) is also free to deploy and use in a production environment, and I could not find any other helpful document.
The FAQ says that "Instant Client is FREE for anyone to use in a development or production environment." It also says immediately following that "Instant Client can be used to run your OCI, OCCI, Pro*C, JDBC, and ODBC applications without installing a full Oracle Client. In addition, Instant Client supports SQL*Plus." [emphasis mine]
I would appreciate any help on this.
Thanks in advance,
Anthony

Why don't you call Oracle sales? I guess they'll be happy to answer your question.
Yours,
Laurenz Albe

Secure Network Servers (SNS) in ISE version 1.1.4

Hi board,
I'm quite confused about the supported ISE versions for the new Cisco Secure Network Server 3415 and 3495.
In nearly all documents it is stated, that the support for this HW will be introduced with ISE 1.2
For example ISE Q&A
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/qa_c67-658591.html
What else is being released with ISE 1.2*?
A. Two new hardware platforms called the Cisco Network Secure Servers*. These new servers bring scalability improvement as they are based on the powerful Cisco UCS® C220 Rack Server platform and configured to support the Cisco Identity Services Engine* (ISE), Network Admission Control (NAC), and Access Control System (ACS) security applications. The multiuse Cisco Secure Network Servers offer many improvements over current ISE, ACS, and NAC appliances, and are the platform recommended to deploy newer versions of these applications. During ordering, customers can specify which security application they would like to have installed. See the Product Details section for more information.
On the other hand, in the 1.1.x release notes it's stated, that the HW is supported in the current 1.1.4 release
http://www.cisco.com/en/US/docs/security/ise/1.1.1/release_notes/ise111_rn.html#wp417581
New Features in Cisco ISE, Release 1.1.4 Cisco ISE, Release 1.1.4 provides support for the Cisco SNS 3400 Series appliance. For details on the installing and configuring the Cisco SNS 3400 Series appliance, refer to the ISE 1.1.4 Installation Guide at the following location:
What is true now? What HW appliance do I chose, if I want to order today?
I don't want to order the old appliances (33xx), because they are already EoL announced:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11640/eol_C51-728424.html
Thanks!

Hi Johanne,
Cisco ISE software is packaged with your appliance or image for installation. Cisco ISE, Release 1.2 is shipped on the following platforms. After installation, you can configure Cisco ISE with specified component personas (Administration, Policy Service, and Monitoring) or as an Inline Posture node on the platforms.
Supported Hardware and Personas:
Hardware Platform Persona Configuration
Cisco SNS-3415-K9
(small)
Any
•Cisco UCS 1 C220 M3
•Single socket Intel E5-2609 2.4-GHz CPU, 4 total cores, 4 total threads
•16-GB RAM
•1 x 600-GB disk
•Embedded Software RAID 0
•4 GE network interfaces
Cisco SNS-3495-K92
(large)
Administration
Policy Service
Monitor
•Cisco UCS C220 M3
•Dual socket Intel E5-2609 2.4-GHz CPU, 8 total cores, 8 total threads
•32-GB RAM
•2 x 600-GB disk
•RAID 0+1
•4 GE network interfaces
Cisco ISE-3315-K9 (small)
Any
•1x Xeon 2.66-GHz quad-core processor
•4 GB RAM
•2 x 250 GB SATA3 HDD4
•4x 1 GB NIC5
Cisco ISE-3355-K9 (medium)
Any
•1x Nehalem 2.0-GHz quad-core processor
•4 GB RAM
•2 x 300 GB 2.5 in. SATA HDD
•RAID6 (disabled)
•4x 1 GB NIC
•Redundant AC power
Cisco ISE-3395-K9 (large)
Any
•2x Nehalem 2.0-GHz quad-core processor
•4 GB RAM
•4 x 300 GB 2.5 in. SAS II HDD
•RAID 1
•4x 1 GB NIC
•Redundant AC power
Cisco ISE-VM-K9 (VMware)
Stand-alone Administration, Monitoring, and Policy Service (no Inline Posture)
•For CPU and memory recommendations, refer to the "VMware Appliance Sizing Recommendations" section in the Cisco Identity Services Engine Hardware Installation Guide, Release 1.2.7
•Hard Disks (minimum allocated memory):
–Stand-alone—600 GB
–Administration—200 GB
–Policy Service and Monitoring—600 GB
–Monitoring—500 GB
–Policy Service—100 GB
•NIC—1 GB NIC interface required (You can install up to 4 NICs.)
•Supported VMware versions include:
–ESX 4.x
–ESXi 4.x and 5.x
1 Cisco Unified Computing System (UCS)
2 Inline posture is a 32-bit system and is not capable of symmetric multiprocessing (SMP). Therefore, it is not available on the SNS-3495 platform.
3 SATA = Serial Advanced Technology Attachment
4 HDD = hard disk drive
5 NIC = network interface card
6 RAID = Redundant Array of Independent Disks
7 Memory allocation of less than 4GB is not supported for any VMware appliance configuration. In the event of a Cisco ISE behavior issue, all users will be required to change allocated memory to at least 4GB prior to opening a case with the Cisco Technical Assistance Center.
Please check the following link for fruther information.
https://supportforums.cisco.com/message/3986953#3986953

Cisco ISE version 1.2.1.198 distribution deployment issue

Dear All, I am having 3 ISE (Admin, PSN & MNT node) running on version 1.2.1.198 with no patch. My MNT node is not sync. with admin node. I need to apply a certificate but getting error. I am unable to deregister it. I have tried to push the patch 3 by installing same on Admin node but it is not getting push to either MNT or PSN node. I am attaching the screen-shots for your reference. Please let me know if you need any input from my side.

Hi, I have made PSN as monitor Primary, then de-registered the Monitor node & registered it back & made it monitor primary. Now all nodes are syncing properly. But after this my call flow is breaking. All user request are going for default deny, i.e. access reject & drop. Earlier it was working properly, users were able to connect / authenticated & authorized also access the websites properly. Earlier only monitor node was not syncing , but now although it is syncing but call flow is breaking & there is no change in configuration. I have updated the ISE version 1.2.1.198 with only a patch , i.e. patch 3 on all 3 nodes i.e. admin, PSN & monitor. Please suggest also let me know incase you need more info.

ISE version 1.3 and static route not working

This command works without any issues with ISE version 1.1 and 1.2:
ip route 192.168.1.1 255.255.255.255 gateway 127.0.0.1
However, it does NOT work in ISE version 1.3. See below:
ciscoisedev/admin(config)# ip route 192.168.1.1 255.255.255.255 gateway 127.0.0.1
% Warning: Could not find outgoing interface for gateway 127.0.0.1 while trying to add the route.
% Error: Error adding static route.
ciscoisedev/admin(config)#
Any ideas anyone?

So it appears that there is no option to lock down access to the shell now that the command that you used to use is no longer valid. What is worse is that there isn't an option to create an ACL in the shell that you could attach to the interface. So I would recommend that you create a defect with Cisco TAC and get this re-added or request that ACL functionality is added.
For the GUI (in case you were not already aware of this), you can restrict access from Administration > Admin Access > Settings > Access > IP Access

ISE version 1.2 licensing question

Similar Messages

Maybe you are looking for