Understand ISE Licensing

Hello,
I am going to Order (SNS-3415-K9) ISE product to deploy at my company, my concern is the size of license I shall order, and how to know the correct number
I have workstations (PC’s), laptops, Printers, IP-CAM’s, and WLC with 50 AP.
How I can determine the number of license I should get in order to have the benefits from Cisco ISE.
Best reagrds,
Samer Hasan

Question:
I am going to Order (SNS-3415-K9) ISE product to deploy at my company, my concern is the size of license I shall order, and how to know the correct number. I have workstations (PC’s), laptops, Printers, IP-CAM’s, and WLC with 50 AP. How I can determine the number of license I should get in order to have the benefits from Cisco ISE.
Cisco Identity Services Engine (ISE) Ordering Steps
Here’s guide which can help in finding solution of your problem
1. Estimate the number of concurrent endpoints in the network.
2. Estimate the number of appliances (physical or virtual) needed to support the number of concurrent endpoints
     in the network.
3. Select the appropriate type of appliance suitable for your deployment. (Reference the appliance selection.)
4. Select the appropriate type of license suitable for your deployment. (Reference the license selection.)
5. Select the appropriate level of services available from Cisco Advanced Services or a Certified Partner for design,
    Deployment and sustaining services of the ISE deployment.
Step 1: Estimate the Number of Concurrent Endpoints in the Network
Estimating the total number of concurrent endpoints is dependent on a number of variables. An approach to consider would be to take into account:
• Number of employees in the organization
• Average number of devices per employee (desktop, laptop, smartphone, desk IP phone, etc.)
• Number of switch ports currently in the organization
• Number of access points deployed in the organization
• Average number of devices per access point
• Dynamic IP address range being used
• Average number of guests expected to join the network
• Inventory of non-user devices such as IP cameras, printers, IP-enabled projectors, etc.
A combination of factors that includes but is not limited to the above factors could be used to determine the total number of concurrent endpoints in the network.
Step 2: Cisco ISE Appliances and Servers* Options
Cisco   Identity Services Engine Appliances
Option 1: Cisco Identity Services   Engine Appliances and Servers*
Product Number
Endpoints Supported
Cisco Secure Network Server 3415*
SNS-3415-K9
5,000
Cisco Secure Network Server 3495*
SNS-3495-K9
20,000
Step 3: Cisco Secure Network Server Support SKUs*
Product   Number
SMARTnet Part Number
Description
SNS-3415-K9*
CON-SNT-SNS-3415
Cisco SMARTnet support for   SNS-3415-K9 - 8x5 Next Business Day
Step 4: Select the Type of License
Step 5: Cisco ISE License Options
License   Type
Features Supported
Deployment Type Supported
License Prerequisite
License Term(s)
Base License
AAA
Guest Provisioning
Link Encryption Policies
Wired
Wireless
VPN
Perpetual
Advanced License
Device Onboarding/Provisioning
Device Profiling and Feed Service*
Host Posture
Security Group Access
Integrated Vendor MDM Support*
Wired
Wireless
VPN
Base License
3- and 5-Year Terms
Wireless License
Device Onboarding/Provisioning
AAA
Guest Provisioning
Link Encryption Policies
Device Profiling and Feed Service*
Host Posture
Security Group Access
Integrated Vendor MDM Support*
Wireless
3- and 5-Year Terms
Step 6. Cisco ISE Functionality-Based License Options
License   Tiers (T)
Number of Endpoints Supported
Base License
Advanced 3-Year License
Advanced 5-Year License
Wireless 3-Year License
Wireless 5-Year License
Wireless Upgrade 3-Year License
Wireless Upgrade 5-Year License
100
100 Endpoints
L-ISE-BSE-100=
L-ISE-ADV3Y-100=
L-ISE-ADV5Y-100=
L-ISE-AD3Y-W-100=
L-ISE-AD5Y-W-100=
L-ISE-W-3UPG-100=
L-ISE-W-UPG-100=
250
250 Endpoints
L-ISE-BSE-250-
L-ISE-ADV3Y-250=
L-ISE-ADV5Y-250=
L-ISE-AD3Y-W-250=
L-ISE-AD5Y-W-250=
L-ISE-W-3UPG-250=
L-ISE-W-UPG-250=
500
500 Endpoints
L-ISE-BSE-500=
L-ISE-ADV3Y-500=
L-ISE-ADV5Y-500=
L-ISE-AD3Y-W-500=
L-ISE-AD5Y-W-500=
L-ISE-W-3UPG-500=
L-ISE-W-UPG-500=
1000
1000 Endpoints
L-ISE-BSE-1K=
L-ISE-ADV3Y-1K=
L-ISE-ADV5Y-1K=
L-ISE-AD3Y-W-1K=
L-ISE-AD5Y-W-1K=
L-ISE-W-3UPG-1K=
L-ISE-W-UPG-1K=
1500
1500 Endpoints
L-ISE-BSE-1500=
L-ISE-ADV3Y-1500=
L-ISE-ADV5Y-1500=
L-ISE-AD3Y-W-1500=
L-ISE-AD5Y-W-1500=
L-ISE-W-3UPG-1500=
L-ISE-W-UPG-1500=
2500
2500 Endpoints
L-ISE-BSE-2500=
L-ISE-ADV3Y-2500=
L-ISE-ADV5Y-2500=
L-ISE-AD3Y-W-2500=
L-ISE-AD5Y-W-2500=
L-ISE-W-3UPG-2500=
L-ISE-W-UPG-2500=
3500
3500 Endpoints
L-ISE-BSE-3500=
L-ISE-ADV3Y-3500=
L-ISE-ADV5Y-3500=
L-ISE-AD3Y-W-3500=
L-ISE-AD5Y-W-3500=
L-ISE-W-3UPG-3500=
L-ISE-W-UPG-3500=
5000
5000 Endpoints
L-ISE-BSE-5K=
L-ISE-ADV3Y-5K=
L-ISE-ADV5Y-5K=
L-ISE-AD3Y-W-5K=
L-ISE-AD5Y-W-5K=
L-ISE-W-3UPG-5K=
L-ISE-W-UPG-5K=
10,000
10K Endpoints
L-ISE-BSE-10K=
L-ISE-ADV3Y-10K=
L-ISE-ADV5Y-10K=
L-ISE-AD3Y-W-10K=
L-ISE-AD5Y-W-10K=
L-ISE-W-3UPG-10K=
L-ISE-W-UPG-10K=
25,000
25K Endpoints
L-ISE-BSE-25K=
L-ISE-ADV3Y-25K=
L-ISE-ADV5Y-25K=
L-ISE-AD3Y-W-25K=
L-ISE-AD5Y-W-25K=
L-ISE-W-3UPG-25K=
L-ISE-W-UPG-25K=
50,000
50K Endpoints
L-ISE-BSE-50K=
L-ISE-ADV3Y-50K=
L-ISE-ADV5Y-50K=
L-ISE-AD3Y-W-50K=
L-ISE-AD5Y-W-50K=
L-ISE-W-3UPG-50K=
L-ISE-W-UPG-50K=
100,000
100K Endpoints
L-ISE-BSE-100K=
L-ISE-ADV3Y-100K=
L-ISE-ADV5Y-100K=
L-ISE-AD3Y-W-100K=
L-ISE-AD5Y-W-100K=
L-ISE-W-3UPG-100K=
L-ISE-W-UPG-100K=

Similar Messages

  • I am trying to understand the licensing procedures for using tabKiller for 3.5.7 firefox. Who should I contact for this? I do not see any customer service phone number for Firefox

    I am trying to understand the licensing procedures for using tabKiller for 3.5.7 firefox. Who should I contact for this? I do not have the customer service phone number for Firefox

    Tab Killer is not created by Mozilla, it is created by a private individual who has made it available at no cost for other people to use.

  • Trying to understand N1k licenses.

    Folks,
    I have a Nexus 1kv switch which shows that some of the licenses may expire soon, I am trying to understand what licenses are these and how can I get them updated?
    aus-clm2-n1kv# sh license
    VSG20121101153332010.lic:
    SERVER this_host ANY
    VENDOR cisco
    INCREMENT NEXUS_VSG_SERVICES_PKG cisco 1.0 1-nov-2013 1 \
            HOSTID=VDH=1932975075133845812 \
            NOTICE="<LicFileID>20121101153332010</LicFileID><LicLineID>1</LicLineID>
            <PAK>FXPAKA0B419</PAK>" SIGN=78C89580C244
    VSG20121101161613079.lic:
    SERVER this_host ANY
    VENDOR cisco
    INCREMENT NEXUS_VSG_SERVICES_PKG cisco 1.0 1-nov-2013 1 \
            HOSTID=VDH=1932975075133845812 \
            NOTICE="<LicFileID>20121101161613079</LicFileID><LicLineID>1</LicLineID>
            <PAK>FXPAKA0B419</PAK>" SIGN=7A973A76F40E
    ASA201308220024150380.lic:
    SERVER this_host ANY
    VENDOR cisco
    FEATURE NEXUS_ASA1000V_SERVICES_PKG cisco 1.0 17-feb-2014 4 \
            HOSTID=VDH=1932975075133845812 \
            NOTICE="<LicFileID>20130822002415038</LicFileID><LicLineID>1</LicLineID> \
            <PAK></PAK>" SIGN=91BCA7806A48
    N1KVFEAT20121004133055620.lic:
    SERVER this_host ANY
    VENDOR cisco
    INCREMENT NEXUS1000V_LAN_SERVICES_PKG cisco 1.0 4-oct-2013 1 \
            HOSTID=VDH=1932975075133845812 \
            NOTICE="<LicFileID>20121004133055620</LicFileID><LicLineID>1</LicLineID> \
            <PAK>FXPAK014A5E</PAK>" SIGN=2987620AC1EC
    N1KVFEAT20121102174655418.lic:
    SERVER this_host ANY
    VENDOR cisco
    INCREMENT NEXUS1000V_LAN_SERVICES_PKG cisco 1.0 19-sep-2013 1 \
            HOSTID=VDH=1932975075133845812 \
            NOTICE="<LicFileID>20121102174655418</LicFileID><LicLineID>1</LicLineID> \
            <PAK></PAK>" SIGN=5E8487884C80
    aus-clm2-n1kv#
    Thanks,
    Nik

    please tell me what the inout in this coode means:A parameter that supplies input as well as accepts output is an INOUT parameter.

  • ISE license for TrustSec

    Hello,
    I want to know  does ISE with Plus-License support  TrustSec features ?     On the TrustSec 5.0 document, it is mentioned that you must have ISE Advance-License for TrustSec support. but  on other-hand on ISE Licensing-datasheet it is written Plus-License (Provides context about endpoints for more detailed access policies).   as per bellow table:
    ISE License Package
    Focus
    Perpetual/Subscription (Terms Available)
    Notes
    Base
    Secured access
    Perpetual
    Plus
    Provides context about endpoints for more detailed access policies
    Subscription (1, 3, or 5 years)
    Does not include Base services; Base licenses are required to install Plus licenses.
    Advanced
    Provides context and compliance details about endpoints for more detailed access policies
    Subscription (1, 3, or 5 years)
    Does not include Base services; Base licenses are required to install Advanced licenses
    http://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/datasheet-c78-730772.html
    Please let me know should I order Advanced or Plus License?      if Plus has this capability will be good for me because of its License pricing
    Thanks,

    At the beginning, there were only the Base- and Advanced licenses. There you needed Advanced for nearly everything that goes beyond basic Authentication and Authorization. In newer versions (starting 1.2.1 and one of ne newer 1.2.0 patch-levels), the plus license was introduced. And many Advanced-features were moved to Plus. As you will probably directly start with a newer version where the new licenses are used, you'll be fine with "Plus".

  • ISE license enforcement alarms

    Getting the following alarm from my ISE:
    Cause:
    Base License Enforcement
    Details:
    Base concurrent users exceed license allowable count
    Currently only using 1656 out of 2000 base licenses so I'm not sure what the issue is. Running 1.1.2.145 patch 3.

    Hello Tom,
    As I am unclear about your issue , to make it more clear can you tell me the exact base licenses  that you have purchased for your endpoints.
    can you send me the BOM regarding  ISE licenses  that you have purchased.

  • ISE licenses and Profiling service

    Hi,
    I tried to find proper explanation of how ISE licenses are used but I am still not sure of one thing.
    With the Plus license, when the profiling service is turned on; is the number of endpoints consumed from the Plus license for every endpoint that has been profiled and successfully authenticated or the number will be consumed from Base license first ?

    A successfully Authenticated device draws from the Base License.
    A Profiled device draws from the Plus License.
    A successfully Authenticated profiled device draws from both. 
    This is why you need at least as many Base as Plus or Apex Licenses.
    Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
    Charles Moreton

  • Basic ISE Licensing question

    Hi,
    Just a question on ISE license consumption.
    If a user logs in and gets authenticated (user authentication) via ISE on a device that is already authenticated (device authentication), does it consume 2 licenses, one for the device and one for the user?
    This is nowhere clearly told in any cisco documentation.
    Can anybody help me clarify this?
    Thank you,
    Mohan

    The base package includes all of the base services required to enable 802.1X, Guest, and Monitoring and Troubleshooting. The advanced package includes Posture, Profiler, and Security Group Access services.
    Cisco ISE is bundled with a licensing mechanism that has the following important features:
    •Built-in License—Cisco ISE comes with a built-in evaluation license, which is valid for 90 days. The evaluation license includes both base and advanced packages and limits the number of endpoints to 100 for both the base and advanced packages. Therefore, it is not required to install a regular license immediately upon installation.
    •Central Management—Licenses are centrally managed by the ISE administration node. In a distributed deployment, where two ISE nodes assume the Administration persona (primary and secondary), upon successful installation of the license file, the licensing information from the primary Administration node is propagated to the secondary Administration node. So there is no need to install the same license on each Administration node within the deployment.
    •Concurrent Endpoint Count—The Cisco ISE license includes a count value for base and advanced packages, which restricts the number of endpoints that use those services. The count value is the number of endpoints across the entire deployment that are concurrently connected to the network and accessing the service.
    Concurrent endpoints represent the total number of supported users and devices. An endpoint can be any combination of users, personal computers, laptops, IP phones, smart phones, gaming consoles, printers, fax machines, or other types of network devices.
    IMPORTANT : - Alarm is generated when the soft limit of endpoints is crossed and there is no functional impact on the users. To avoid service disruption, Cisco ISE continues to provide services to endpoints that exceed license entitlement. However there are plans to implement a hard limit on this soon.
    Regards,
    Jatin Katyal
    ** Do rate helpful posts **

  • Cisco ISE licensing...

    Hi,
    seeking help to reduce our ISE licensing cost, actually we are out budget and we planning to order ISE licenses less than what we required, and looking for efficiently using the same, is there any way, i mean if we reduce "user idle timeout" is it reduce our license consumption?
    any kind help appreciated...
    thank you,

    License Count
    A Cisco ISE user consumes a license during an active session. Once the sessions has ended, ISE releases the license for reuse by another user.
    The Cisco ISE license is counted as follows:
    A Base, Plus, or Advanced license is consumed based on the feature that is used.
    An endpoint with multiple network connections can consume more than one license per MAC address. For example, a laptop connected to wired and also to wireless at the same time. Licenses for VPN connections are based on the IP address.
    Licenses are counted against concurrent, active sessions. An active session is one for which a RADIUS Accounting Start is received but RADIUS Accounting Stop has not yet been received.

  • Exceeding ISE license counts - performance consequences?

    Hello,
    I have a customer that is running a 2-node ISE deployment and is licensed for 250 Base and 250 Adv. users.
    We have moved the wired users over in one of their offices into Monitor Mode only, and the Base/Adv. Active license counts have exceeded both these values.
    Long-term, what is the operational impact?
    I understand from Chapter 7 of the ISE User Guide that "To avoid service disruption, Cisco ISE continues to provide services to endpoints that exceed license entitlement. Cisco ISE instead relies on RADIUS accounting functions to track concurrent endpoints on the network and generate alarms when endpoint counts exceed the licensed amounts"
    My question is, that aside from a scenario where TAC is engaged and they see the license count exceeded, what is the operational and functional impact of exceeding the license count.  I know that ISE continues to process autthentications, because the 251st client is not refused access.
    I've read the Order Guide and the User Guide and the Hardware Guide, and no actual impact is mentioned.
    thanks in advance,
    Andrew

    I had a similar question. I asked how does ISE calculate users. In the wlc I would see 10k radius clients but ISE would show half that number. This is what I was told:
    Unfortunately there is no documentation on it. The active endpoints are calculated from the active sessions seen on the primary monitoring node session database, meaning active client sessions seen by PSNs and reported to the primary monitoring node. As to the rules that qualify an endpoint as active, there isn?t really even any internal documentation on that. The effective behavior seen indicates that this is calculated by endpoints who authenticate and continue to re-authenticate/periodically trigger accounting updates from NADs. Hopefully this helps!
    Tac case # 627456397
    Sent from Cisco Technical Support iPad App

  • ISE License After Newly Installation

    Hi Guys,
    We have a ISE appliance 3355 running version 1.1.1 and the base license is already installed into it. For now, we wanna change the version into 1.2, but we only have the full installation IOS of 1.2 which means we do not have the upgrade path from 1.1.x to 1.2. I wanna know if the license will be lost after we freshly installing the full version of 1.2 instead of upgrading. THX!
    Regards

    But wait, who said that you are limited to the full upgrade only?
    You can upgrade from 1.1.1 to 1.2 with the upgrade bundle if you have the latest patch applied to the 1.1.1 version.
    This is as per the upgrade guide:
    http://goo.gl/kTVSBq
    or you menat that you don't have the file of the upgrade bundle itself?
    Regards,
    Amjad
    Rating useful replies is more useful than saying "Thank you"

  • ISE License for WLC

    Hello Experts
    i have ISE with advanced license for 1500 user , and i have WLC 2504 , and i need to integrate the WLC with the ISE to get ISE features for the Wireless users  like posturing , remediation and the authentication as well .
    my question : is the advanced license is enough , or shall i install the Wireless License to the ISE to have the integration...
    your feedback and inputs appreciated....
    Reyad

    Here is some information regarding the different types of licenses -
    http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_man_license.html#wp1074395
    Essentially a wireless license is much like the base license if your deployment is 100 percent wireless, the wireless upgrade is the equivalent to the advanced license once again for only a wireless deployment.
    Base and Advanced covers all (wired, wireless, vpn..etc). there are no restrictions to the deployment model.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • ISE Licensing for IP Phones nodes

    Hi Guys,
    I'm currently worknig on an ISE design for a network where they have IP Phones for each end user device:
     Switch <--> IP Phone <--> End User Device.
    My concern is the licensing part; i'm not really interested in authenticating or profiling IP Phone nodes. rather i need only to provide full ISE services for End user devices behind IP Phones (Authenitcation,Authorizatino,Posturing....etc.). so i need to order a base and an advanced license that cover ONLY the number of end user devices without accounting for IP Phone units.
    Considering the above requirements ; what is the best deployment scenario to consider when configuring the switch interface that connect to each IP Phone with Single host port authentication (cdp bypass). would the ip phone consume from license count.
    What if we considered doing MAB for IP Phone nides and Dot1x for End users and considering MDA ? would it consume 2 units from total license number of nodes in this case ?
    What is the best practice for deploying and licensing ISE if i Cisco or a Third Party IP Telephony solution and i don't want to autheticate/authorize/profile ip phones ? 
    Thanks,
    Muayad Jallad,

    If you are using Cisco IP phones you can get away with single-host mode on the port which in effect ignores the phone. If the phone is a third party device you will most likely need to use multi-domain authentication and actually use ISE to allow the phone on the network.
    In summary - CIsco phone means potentially no license, if Avaya or other third party you will need to auth and use a license

  • Cisco ISE license file

    I would like to backup the license file to apply for a fresh installation on the same hardware (3355). Is that possible? I tried resetting the configuration from the CLI and the license was excluded, it was necessary to do a restore.

    By re-hosting you can do:
    please check the link https://supportforums.cisco.com/discussion/11728041/ise-license

  • ISE License

    Dear Team,
    Please help me for the below mentioned ISE deployment
    I want to deploy ISE in a DC & DR environmental. There are two WAN links used for both location at a time e.g. 
    1.  A (DC)    & B (DR)   if either of the link down then traffic will be forward by the other location either A or B.
    2. There are MPLS connectivity between DC & DR sites.
    3. I want to go with two ISE appliances (2 for each sites).
    4. Please suggest license option for 500 users (Basic+ advance).
    5. Shall I require only one license for all the appliances (Basic+ Advance).
    6. I want to run both the site active at a time.
    Please suggest appr. license for all the appliances in this case.
    Thanks & regards,
    Rajesh Kumar

    Hello Rajesh,
    As you asked me again, I think you have some doubts.
    We will need just one set of Lincense per primary Admin persona per ISE deployment.
    I think you have ISE deployment as follows.
    India (DC) - ISE1:Admin&MnT (Primary) + ISE2:PSN
    USA (DR) - ISE3:Admin&MnT (Secondary) + ISE4:PSN
    If you have above mentioned scenario then you will need to install only one set of license on India (DC) - Admin&MnT (Primary)
    But If you have a ISE deployment as follows then you will need two sets of license.
    India (DC) - ISE1: (Primary)Admin&MnT&PSN  + ISE2:(Secondary)Admin&MnT&PSN
    USA (DR) - ISE1: (Primary)Admin&MnT&PSN  + ISE2:(Secondary)Admin&MnT&PSN
    The Above mentioned deployement are completly saperate ISE deployments. so here you will need two sets of license one on India (DC) - ISE1: (Primary)Admin&MnT&PSN and second on USA (DR) - ISE1: (Primary)Admin&MnT&PSN
    Please let me know what kind of ISE deployment you are planning for...
    Thanks,
    Chandrashekhar More

  • Changing ISE hostname with application reset-config ise - license question

    Hello,I need to change the hostname of our ISE install.  TAC stated I need to use the command of application reset-config ise to do so.  I was wondering if my old license files can be reused or do I need to get new ones from Cisco.  I have a case open, but this work is being done this evening so I need an answer as soon as possible. Also, if any of you have any tips or tricks to get me through this process, I would love hearing them.Thank you!

    Thank you for the quick reply. I would just like to clarify that I can use the license files that were sent to me when we initially purchased the product.  I have to do the work tonight and don't want to hose my installation if I need to get new license files from Cisco.

Maybe you are looking for

  • I'm fed up with Siri

    Hi, I noticed that there is an entire section for Siri here, but I'm so upset, I felt the need to create my own thread. I purchased an iPhone 4S for one reason: because of Siri - why? Because I travel in areas where I want to keep my iphone safe in m

  • How to display a combobox(dropdown menu) in a jsp page?

    Hi friends, I need to create a jsp page which contains three text fields and a single dropdown menu,,, . and my functionality is while loading the page itself that dropdown menu gets the data from database and holds in it..... i mean the data in thea

  • Ripped DVD, Converted to QT, Cant preview in FCE

    I have bits and peices of a DVD that I ripped using Mactheripper, then converted by Handbrake, then converted to Quicktime. I can view the clips in Quicktime. I can import the QT Clips into FCE and see them in the browser. I can put those clips into

  • IPsec default exemptions for Server 2008 R2

    Hello Everyone, We are using IPsec in our domain environment all servers are windows server 2003 and 2003 R2. Now we are upgrading to server 2008 R2. With Windows server 2003 and 2003 R2 we used exempt some traffic from IPsec now with Windows Server

  • Optimize after 10.9.5 update

    After I updated from 10.9.4 to 10.9.5, I had a small window next to Notifications saying something about Optimize my Mac or else  -.. I forget, battery life or slower until I optimize.  I clicked on it & noting happened. I could only click "close." T