CISCO ISE and MERAKI LICENSE

[wmendozaOpenlink]

Hello team, I wanted to know if anyone knows if for MS390 and MR46 with Cisco ISE, an Enterprice license only in Meraki is enough? I have a little confusion with the Advance licenses for the use of adaptive policies and ISE

Can ISE use a license like Advantage for SGT usage and more, and can Meraki use Enterprice licenses? Or... do you necessarily need both licenses, that is, advantage in Cisco and advance in Meraki?
I see that with a solution like ISE clearly adaptive policies would no longer be needed since SGT would now be covered by ISE. It's right?

[ammahend]

if you need to do adaptive policy you need advance licenses on your AP and MS390 irrespective of what license you have on ISE, the tagging can come natively from meraki or can be assigned by ISE as part of authorization (which is preferred method).

Also, dont confuse trustsec with adaptive policy, they both use sgt but meraki adoption is different, adaptive policy does not require policy matrix to be created in ISE unlike trustsec, you build the policy in Meraki dashboard itself, only sgt are assigned by ISE.  

[wmendozaOpenlink]

I'm a little confused here, if i understand that Adaptive Policy use SGT, correct? and ISE uses SGT (TrustSec), is that correct? What I mean is that adaptive policies wouldn't really be necessary if you use ISE with advantage licenses, am I correct?

[ammahend · Accepted solution]

if you have Meraki infrastructure and want to build sgt based microsegmentation then you need adaptive policy hence you need advance licenses on meraki switches and AP, if you already have enterprise license then you need to purchase upgrade license. In this case i dont think you need ise advantage license, you can assign sgt using just enterprise license also, now what you want to do with sgt is based on policy, which is created on meraki dashboard. 

if you have Cisco infrastructure and want to do sgt based microsegmentation then you need trustsec capable cisco devices and cisco ise with advance license. in this case the policy is built on ISE itself and pushed down to cisco devices. 

[wmendozaOpenlink]

Well, this is the case of a client who wants a Meraki infrastructure, and wants to involve an ISE, for this reason I see that it is better to use ISE for SGT, and the basic licenses in Meraki, I think that also ISE ends up being a little more robust than Meraki Adaptive Policy

[ammahend]

As i mentioned before if they have Meraki infrastructure with MS390 or new 9300-M, they need Meraki advanced license to do adaptive policy irrespective of what license you have on ISE,  If they dont want to do adaptive policy, then they dont need advance license. 

review this document

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy/Adaptive_Policy_Overview