Licensing Requirements for Envoy Integration

[Stephen Colby]

We have a customer who is pricing out ISE and the question of how would the Envoy ERS Integration be licensed came up.  The ordering guide doesn't go into much detail.  Since Envoy is using the ERS API to add guest users to ISE, this would not be an active session until the guest actually logs into the wifi.  Is there any additional Plus licensing consumed for Envoy to create the guest users until they expire?

[Jason Kunst · Accepted solution]

All guest functionality utilizes the base license
Table 1 page 18
https://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

[jasslagl]

Just to clarify a bit more - The Envoy solution ties into ISE via ERS enablement. Envoy is used to manage/alert of guests at a corporation - usually the guest enter their information on a IPAD like device which will then alert the employee that they have a guest waiting. The integration into ISE allows the auto provisioning of guest network access. The question is - does this require only a Base license and is the license only consumed when the user actually authenticates on the network? I have read that ERS enablement requires plus licensing, but I believe this is only if context is being shared which I don't see it being the case with the Envoy solution - but not 100% sure.

Thanks!

[Jason Kunst · Accepted solution]

Per the ordering guide API only requires base to enable it. Its not a consumption model. There is no consumption under the guide mentioned either.

Base licensing is consumed for guest when a device does MAB for active endpoints only

[Stephen Colby]

Please see Jason's clarifying questions. The table you linked is something we have seen and it does not answer our question about the mechanism used to consume licenses when integrating with Envoy.