Max number of licenses available for Cisco ISE

[Gioacchino]

I'm speaking of Essentials/Advantage/Premier. We use on-prem SSM.

is there way to know how many licenses Cisco ISE gets from the binding to a virtual account on Cisco SSM?

The only piece of information is the consumed ones, like knowing how many you are entitled to use were not important.

I just put myself in the shoes of those who bring up the Cisco ISE instance and they have to go live. There might be many scenarios where things went wrong and you won't know.

1) Cisco ISE joined the wrong virtual SSM account where there are no licenses, if you are still in the evaluation period, you are capped to 100 end-points;

2) Cisco ISE joined the correct virtual SSM account, but for some reasons te licenses are not retrieved.

Have you found a way to retrieve such piece of information?

Regards, Gio

[balaji.bandi]

As i remember correctly  smart account usage policy.

[Gioacchino]

What do you mean? I cannot find this information.

Gio

[ahollifield]

What are you asking?  ISE will request from the SSM however many licenses it needs.  SSM would then consume those from the Smart Account.

If you are outside of license compliance and don't have enough licenses to cover your ISE instance, there is a grace period.  After that period is up, then the GUI will eventually lock you out from all portions of the UI except for the licensing page.  All authentications continue to work though.

[Gioacchino]

Hi @ahollifield ,

my question was how to see the maximum number of licenses available within the ISE itself. It might be that ISE and SSM are managed by different teams.
As I said, SSM team generate a tokem, but they choose the wrong virtual account (call it mistake, between-the-teams miscommunication, whatever...). ISE admins don't have any way to have a confirmation that the link between ISE and SSM has been correctly set up.

Then, let's say, you must go live and... you discvers mistakes at that stage.

In short, reflecting such information in the ISE as well, may avoid misunderstandings.

Anyway, I worked with Cisco TAC India, wonderful people; they confirmed that for the moment what I'm asking is not possiblem but they add my case to the existing enchancement request, or they will create one expressly.
I hope I've made it clear.

Gio

[Gioacchino]

Indeed they opened an enchancement request, the more hits the more chances it gets taken into consideration.

[ahollifield]

You don't.  This information is only available in the SSM or Smart Account.  The ISE UI will only display how many licenses it has checked out.

[Gioacchino]

Indeed, as I explained to TAC, SSM and licenses might be managed by a different team than the network team. If the ISE instance is linked to the wrong virtual account and the license people don't know very well SSM, there is no way for the ISE admin before going live that everything has been correctly set. Then finger-pointing or shifting-the-blame are the activities that naturally follow afterwards.
Mine was just a suggestion to TAC to improve the administration of ISE (and I guess other devices that rely on the SSM license model).

[Aref Alsouqi]

If those licenses were brought into your SSM from EA portal, then I think in the EA portal there is a way to see the maximum available licenses based on what you purchased. I can't remember where that exactly is but I know for sure it's there at somewhere.

[Gioacchino]

Thanks @Aref Alsouqi , I might be learnign something, but I'm missing what EA stands for here. What do you mean?

[ahollifield]

Enterprise Agreement

[Aref Alsouqi]

Apologies for the delay @Gioacchino, as @ahollifield mentioned it is the Enterprise Agreement, take a look at this link for more info please:

Enterprise Agreement - Cisco