Re-hosting CIsco ISE SNS-3515 -> SNS-3715

[victormanuelsolis]

Hello,

I have doubt about re-hosting the licenses(essentials) on Cisco SNS-3515 to a SNS-3715, is this possible? if so, are there any restrictions or something that avoid the re-hosting between these two devices?

Thanks in advance

[Arne Bier]

Hi @victormanuelsolis 

Your SNS-3515 is running ISE 2.7?

Remember that SNS-3715 will only run a version of ISE that mandates Smart Licensing. So therefore, there will be no license re-hosting possible

Any ISE 2.7 licenses you have today (e.g. TACACS or Base/Plus/Apex) will need an equivalent in the Smart License Virtual Account

You can convert your TACACS license from Traditional to Smart - you should then have 50 TACACS licenses in Smart, that your new SNS server can use

You cannot convert Base/Plus/Apex to the new Essentials/Advantage/Premier - that will require a purchase of those subscriptional licenses.

[victormanuelsolis]

Hello @Arne Bier ,

Sorry, I forgot some additional details, currently we are running 2.7 on the s 3515, however, we are planning to do the upgrade to 3.0 with the new essential licenses, however, I saw the end of support for the HW on 3515 is in June 2024, we will trying to aquire new hardware, that's why I need to know if we can migrate the new essentials licenses working in the future version 3.0 on the 3515, to the more recent hardware so far. Our environment is air-gapped

[ahollifield]

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-0.html

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/eos-eol-notice-c51-742122.html

Do you have a satellite smart license server?  You will need someway for the PAN to talk to the licensing portal.  

[victormanuelsolis]

There is no way to keep the traditional licenses (essentials) as same as Base licenses on 2.7? our environment is totally isolated from internet.

[Arne Bier]

ISE 2.7 supports both licensing types - Traditional (files installed on the PAN) and Smart (PAN talking to Smart Server).

If you are re-homing your Traditional Licenses that were created with the UDIs (Serial Numbers) of the old PPAN and SPAN nodes, then you can re-home those to the new UDIs of the new servers. I have never done it - not sure if there is a webpage to self-serve or if you need TAC.

[Greg Gibbs · Accepted solution]

If ISE is completely air-gapped, you will likely need to look at the options around Specific License Reservation (SLR). There is also a Permanent License Reservation (PLR) option, but that is only available for specific industries (like government) and must be approved by the BU. You would need to speak to your Cisco account team regarding the PLR option.

See the Cisco ISE Licensing Guide for more info