cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7561
Views
10
Helpful
23
Replies

Importing/Uploading ISE License

dot1x
Level 3
Level 3

Hi Members,

Could someone assist me how to upload ISE license?

We are running ISE 1.3 and our licenses expired.

Cisco provided us with 60 days temporary licenses (Zip File).

Would restart be required once we import the license?

1 Accepted Solution

Accepted Solutions

gbekmezi-DD
Level 5
Level 5

No, no restart required. You may have to log out and log back in if GUI elements need to be updated. Unzip the file and upload the license file(s) the zip file contains. The instructions are well documented. Step 5 here: http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2

George

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

View solution in original post

23 Replies 23

gbekmezi-DD
Level 5
Level 5

No, no restart required. You may have to log out and log back in if GUI elements need to be updated. Unzip the file and upload the license file(s) the zip file contains. The instructions are well documented. Step 5 here: http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#task_67E1EAD0C3BF4BA1A9104F8547541AB2

George

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

Thanks George.

I was concerned if I'd have to restart the box.

I'll give it a try and will update the post.

Thanks again.

If you have a secondary PAN you need to apply the license to the Secondary as well (of course, the license has to be generated with the UDI of the Secondary, or else it doesn't match).  And getting a license onto a Secondary PAN requires deregistering the node, apply license, and then registering again.  At least that is my experience in ISE 2.1 & 2.2.

Hi Arne,

So we provided Cisco the Primary and Secondary PANs UDIs and they provided us with a license file.

Do we need to apply the same file to both Primary and Secondary PANs?

Hi Moin

yes indeed.  The same license file(s) should contain the UDI details of both PAN nodes.  You can open the files with a text editor to have a look (look for strings <PrimaryUDI> and <secondaryUDI>).

Applying licenses only works when the node is in STANDALONE or PRIMARY node.  This means if your Secondary PAN is registered, it will be SECONDARY - you will have to deregister it first, apply license, and then register it again.

So here's what I should do?

1. De-register Secondary PAN.

2. Apply license to Primary PAN.

3. Apply license to Seondary PAN. (same license file)

4. Register Secondary PAN with Primary.

Yup.  Same file is used on both servers.

If you still have your eval licenses in place then I would delete those as well.  Not sure if they automatically get removed from the system after 90 days (I would hazard a guess and say "no").  But mostly because having those eval licenses hanging around will enable features that you don't want/are entitled to (e.g. Assuming you only purchased BASE, then your menu options will change once you delete the eval Plus license).  No idea what happens when eval licenses are left lying around after 90 days.  Perhaps the menus will automatically adapt to the new (reduced) feature set.

cheers

We had wireless only license which expired. Cisco issued with 60 days temporary licenses to us.

L-ISE-W-S-500=

Also, I just checked the license file, it has exactly similar Primary and Secondary UDIs.

Should I check back with Cisco?

Not sure about the circumstances of how you got those licenses - probably best to check with Cisco.  If it's just a demo type license then I would not worry about it.  But if it's for production, and you want your Secondary PAN to actually have a license for that instance when you have to fail over to it (usually that is not the best time to realise you have no license on your Secondary!!!) then get it sorted out now.

If it was a purchased licensed with a PAK, then in theory you can amend (re-home) a license in the Cisco licensing portal.  I tried that and it didn't work - eventually opened a support ticket with Cisco licensing and they sorted it out pretty quickly.

Thanks mate, I'd check with Cisco as it's a production environment.

But the license file must have different UDIs for Primary and Secondary, right?

Yes.  When you try to upload the license to a PAN node, where the UDI does not match, then the license import will fail.

You can get the UDI from each PAN via CLI

show udi

Part of the license file looks like this

<PrimaryUDI>ISE-VM-K9:V01:E9********4</PrimaryUDI><secondaryUDI>ISE-VM-K9:V01:MFF******A</secondaryUDI>

Thanks mate, I'll check with Cisco and will update the post.

hslai
Cisco Employee
Cisco Employee

In an ISE deployment, just import the license files to the primary ISE node. There is no need to import them to the secondary admin node so please DO NOT deregister an ISE node solely to import licenses.

secondaryUDI

is optional and is there if you would like a redundancy for licensing in case later the 2nd PAN promoted to primary and in case you need to reimport the licence files for some reason.

Is this true for ISE 1.3 as well?

If we need redundancy, do I need to import license to secondary node as well?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: