Cisco Ise 13 User Guide

1TheadministratorsendsanRSASecurIDchallenge.
2RSASecurIDreturnsachallengeresponse.
3TheadministratorentersausernameandtheRSASecurIDchallengeresponseintheCiscoISElogin
dialog,asifenteringtheuserIDandpassword.
4TheadministratorensuresthatthespecifiedIdentityStoreistheexternalRSASecurIDresource.
5TheadministratorclicksLogin.
Uponloggingin,theadministratorseesonlythemenuanddataaccessitemsthatarespecifiedintheRBAC
policy.
Configure a Password-Based Authentication Using an External Identity Store...

Step 5FromtheExternalGroupsdrop-downlistbox,choosetheActiveDirectorygroupthatyouwanttomapfor
thisexternaladministratorgroup.
Clickthe“+”signtomapadditionalActiveDirectorygroupstothisexternaladministratorgroup.
Step 6ClickSave.
Configure Menu Access and Data Access Permissions for the External Administrator Group
Youmustconfiguremenuaccessanddataaccesspermissionsthatcanbeassignedtotheexternaladministrator
group.
Procedure
Step 1ChooseAdministration>System>AdminAccess>Permissions.
Step...

Step 3ClickSave.
Ifyouloginasanadministrator,andtheCiscoISERBACpolicyisnotabletoauthenticateyouradministrator
identity,CiscoISEdisplaysan“unauthenticated”message,andyoucannotaccesstheAdminportal.
Configure Admin Access Using an External Identity Store for Authentication with Internal Authorization
Thismethodrequiresyoutoconfigurethesameusernameinboththeexternalidentitystoreandthelocal
CiscoISEdatabase.WhenyouconfigureCiscoISEtoprovideadministratorauthenticationusinganexternal...

   Cisco Identity Services Engine Administrator Guide, Release 1.3
118
Administrative Access to Cisco ISE 

CHAPTER 7
Cisco ISE Licenses
ThischapterdescribesthelicensingmechanismandschemesthatareavailableforCiscoISEandhowto
addandupgradelicenses.
•CiscoISELicenses,page119
•LicenseConsumption,page121
•ManageLicenseFiles,page123
Cisco ISE Licenses
CiscoISElicensingprovidestheabilitytomanagetheapplicationfeaturesandaccess,suchasthenumberof
concurrentendpointsthatcanuseCiscoISEnetworkresources.
Tomaximizeeconomyforcustomers,licensinginCiscoISEissuppliedindifferentpackagesasBase,Plus,
Apex,andMobilityUpgrade....

•YoucannotupgradetheEvaluationlicensetoanPlusand/orApexlicensewithoutfirstinstallingthe
Baselicense.
•CiscoISEallowsyoutousemorePlusand/orApexlicensesonthesystemthanBaselicenses.For
example,youcanhave100BaselicensesandPluslicenses.
•WhenyouinstallaMobilityUpgradelicense,CiscoISEenablesallWired,Wireless,andVPNservices.
Table 7: Cisco ISE License Packages
NotesISEFunctionalityCoveredPerpetual/Subscription
(TermsAvailable)
ISELicensePackages
•Basicnetworkaccess:
AAA,IEEE-802.1X
•Guestmanagement...

Youcanonlyinstalla
MobilityUpgrade
Licenseontopofan
existingMobility
license.
Provideswiredsupportto
Mobilitylicense
Subscription(1,3,or5
years)
MobilityUpgrade
AllCiscoISE
appliancesaresupplied
withanEvaluation
license.
FullCiscoISEfunctionalityis
providedfor100endpoints.
Temporary(90days)Evaluation
License Consumption
Youpurchaselicensesforthenumberofconcurrentusersonthesystem.ACiscoISEuserconsumesalicense
duringanactivesession(alwaysaBase;andaPlusandanApexlicense,ifyouusethefunctionalitycovered...

View License Consumption
Youcanviewyoursystem'scurrentlicenseconsumptionfromtheLicensingdashboardat:Administration
>System>Licensing.Consumptionisportrayedasinthefollowingimage:
Figure 12: Traditional License Consumption
TheLicenseConsumptiongraph,intheLicenseUsagearea,isupdatedevery30minutes.Thiswindowalso
displaysthetypeoflicensespurchased,thetotalnumberofconcurrentuserspermittedonthesystem,andthe
expirydateofsubscriptionservices....

Possible Causes
Duetoauthorizationpolicymis-configuration,theLicensingdashboardcanshowthatCiscoISEisconsuming
alicenseyouhavenotpurchasedandregistered.BeforeyoupurchasePlusandApexlicenses,theISEuser
interfacedoesnotdisplaythefunctionalitycoveredbythoselicenses.However,onceyouhavepurchased
theselicenses,theuserinterfacecontinuestodisplaytheirfunctionalityevenafterthelicensehasexpiredor
exceededitsendpointconsumption.Thus,youareabletoconfigurethemevenifyoudonothaveavalid
licenseforthem.
Solution...

Afteroneday,Ciscosendsyouthelicensefile.
Step 4Savethislicensefiletoaknownlocationonyoursystem.
Step 5FromtheCiscoISEAdministrationportal,chooseAdministration>System>Licensing.IntheLicense
Filessection,clicktheImportLicensebutton.
Step 6ClickChooseFileandselectthelicensefileyoupreviouslystoredonyoursystem.
Step 7ClickImport.
Thenewlicenseisnowinstalledonyoursystem.
What to Do Next
Choosethelicensingdashboard,Administration>System>Licensing,andverifythatthenewly-entered...