Ordering Cisco Identity Services Engine (ISE) licenses is a two-part sizing exercise: choose the deployment form factor, then buy endpoint-based subscriptions in nested tiers. Cisco's official Cisco ISE Licensing Guide defines the packaging — three nested tiers (Essentials, Advantage, Premier), two perpetual licenses for device administration and virtual appliances, and three Smart Licensing methods — reworked here into one ordering walkthrough with a compliant BOM, complementing the earlier DNA licensing guide.
The building blocks: what an ISE deployment requires
An ISE deployment needs three things: the appliance, the software license, and support. Appliances run on SNS 3800 hardware (small SNS-3815-K9, medium SNS-3855-K9, large SNS-3895-K9), on VMs (VMware, KVM, Hyper-V, Nutanix AHV, OpenShift), or as IaaS on AWS, Azure, or Oracle Cloud. Support splits by form factor — ISE hardware carries no complimentary basic support. Evaluate free with the built-in 90-day license (100 endpoints, all features); note it expires silently with no alarms. Extensions need an SCM case with the PANs' UDIs.
Essentials, Advantage, and Premier: the nested tier model
The tiers are nested: Advantage includes all Essentials features, and Premier includes everything in both. Size quantity to the maximum number of active endpoints expected to connect concurrently on any given day, not headcount. Consumption is measured through RADIUS sessions: a license is consumed when a session starts and released when it ends. Two traps: MAC randomization (privacy MAC) inflates counts, and where RADIUS sessions can't be counted, Cisco falls back to unique endpoint attributes. Under ISE 3.5 the tiers are unchanged, but tracking is visibility-only — monitor peak endpoints and expect non-disruptive Consumption Alerts until a future release enforces them.
| Feature | Essentials | Advantage | Premier |
|---|---|---|---|
| AAA and 802.1X | X | X | X |
| Guest (Hotspot, Self-Reg, Sponsored) | X | X | X |
| Easy Connect (Passive ID) | X | X | X |
| Profiling | — | X | X |
| BYOD | — | X | X |
| pxGrid / pxGrid Cloud / pxGrid Direct | — | X | X |
| User Defined Network | — | X | X |
| TrustSec (Group-Based Policy) | — | X | X |
| Endpoint Analytics | — | X | X |
| Rapid Threat Containment (ANC) | — | X | X |
| Posture assessment and remediation | — | — | X |
| MDM compliance | — | — | X |
| Threat-Centric NAC | — | — | X |
Each endpoint consumes one license at the highest tier its authorization policy needs — an endpoint using several Advantage features still consumes a single Advantage license.
License SKUs: subscription, Device Admin, and VM
A-la-carte orders use three SKU roles: a subscription SKU for term and start date, product SKUs for tier and quantities, and a support SKU for the service level. The single subscription SKU, ISE-SEC-SUB, is unpriced on its own, ordered in quantity one (one subscription per customer), defaults to a 36-month term in Cisco Commerce, and provisions within up to 72 hours. Product SKUs order from quantity 50, in 1-, 3-, or 5-year terms, prepaid on a tiered model. The default start date is three days after purchase, adjustable up to 90 days out.
| SKU | License type | Unit / basis | Notes |
|---|---|---|---|
| ISE-SEC-SUB | Subscription anchor | Qty 1 / customer | Unpriced alone; sets term (default 36 months) and start date; up to 72h provisioning |
| ISE-E-LIC | Subscription (term) | Active endpoints | Essentials tier; 1-, 3-, 5-year terms; min 50; tiered prepaid pricing |
| ISE-A-LIC | Subscription (term) | Active endpoints; includes all Essentials features | |
| ISE-P-LIC | Subscription (term) | Active endpoints | Premier tier; includes Advantage and Essentials features |
| L-ISE-TACACS-ND= | Perpetual | Per PSN | Device Admin; one per PSN with TACACS+ enabled |
| R-ISE-VMC-K9= | Perpetual | Per virtual / cloud node | One per VM or IaaS-deployed ISE node |
| R-ISE-VMF-K9= | Perpetual | 1 quantity | Free for eligible first-time customers via Catalyst Advantage for Switching |
| CON-L1SW-RISE9KVM | Term support | Per VM | Enhanced software support for virtual machines |
| SVS-ISE-SUP-B | SWSS Basic | All endpoints | Included for the subscription duration |
| SVS-ISE-SUP-S | Solution Support | All endpoints | Percentage of product cost; one level across all endpoints |
| SVS-ISE-SUP-E | SWSS Enhanced | All endpoints | Recommended level for ISE subscriptions |
| SVS-ISE-SUP-P | SWSS Premium | All endpoints | Prioritized handling, solution-level engineers, onboarding help |
Beyond a-la-carte: Enterprise Agreements, embedded ISE Advantage in the Catalyst Subscription for Switching, or AWS/Azure marketplace private offers.
Smart Licensing: CSSM, SSM On-Prem, and SLR
Connected deployments register to the cloud Smart Software Manager (CSSM), directly or via proxy — Cisco's recommended default. Air-gapped sites with a local server use SSM On-Prem (sync automatic online, manual offline; offline recommended). Highly secured networks use Specific License Reservation (SLR), activating licenses without reporting usage — but SLR breaks nesting: reserve each tier separately, since a higher-tier license does not automatically cover lower tiers in SLR mode, and the total reserved must not exceed what was purchased. Mirror tiers and quantities on both PANs — 100 reserved on the primary but 1 on the secondary means a 30-day grace period on failover; 100/100 fails over cleanly. Over 100% of purchased endpoints, or expired licenses, triggers daily GUI alerts. Under ISE 3.5, use the Historical Peak License Consumption report (Reports > Audit > License Usage) to check usage before enforcement arrives in a later release.
Renewals, cancellations, and modifications
Subscriptions auto-renew for 12 more months by default — no new quote needed — with reminders from 120 days out. Cancel up to 60 days before the new term; miss it and the term renews, and mid-term cancellation for credit is never allowed. Manual renewals come in 12-, 36-, or 60-month terms via the Change Subscription quote process, and products, quantities, and terms can change at any time — including tier upgrades.
| Aspect | Renewals | Modifications | Migration |
|---|---|---|---|
| Term options | Auto-renew 12 months; manual renewals at 12, 36, 60 months via Change Subscription quote | Change products, quantities, terms anytime; tier upgrades included | EA: 1.5 years free of ISE 3.x, through July 25, 2026 |
| Reminders | From 120 days before term end; invoice at new term start | — | — |
| Cancellation | Cancel up to 60 days before the new term; no mid-term cancellation for credit | — | — |
| Model shift | — | — | Legacy Base, Plus, Apex reached EOL; 2.x customers upgrade to ISE 3.x and the tier model |
| VM licenses | — | — | VM Small/Medium/Large → VM Common (R-ISE-VMC-K9=) 1:1; classic PAK VM must convert to Smart Licenses in 3.0; old VM support PIDs ended Mar 31, 2025; 180-day renewal window |
| Device Admin | — | — | Classic cluster license → per-node license (L-ISE-TACACS-ND=) via Smart Account |
| Compliance | Over 100% of purchased endpoints or expired licenses trigger daily GUI alerts; under ISE 3.5 these are non-disruptive Consumption Alerts, enforcement deferred to a future release | ||
Worked example: a subscription BOM for a 2,000-endpoint deployment
A university peaks at 2,000 concurrently connected endpoints — 1,400 core NAC only (AAA, 802.1X, guest), 450 needing profiling, BYOD, TrustSec, and pxGrid with its SIEM, and 150 needing posture with MDM compliance — running on 6 virtual nodes with TACACS+ on 2 PSNs. The BOM: ISE-SEC-SUB × 1 — subscription anchor, 36-month term, start date aligned with the VM rollout; ISE-E-LIC × 1,400 — Essentials, 3-year term; ISE-A-LIC × 450 — Advantage, 3-year term; ISE-P-LIC × 150 — Premier, 3-year term; L-ISE-TACACS-ND= × 2 — perpetual Device Admin, one per TACACS+ PSN; SVS-ISE-SUP-E — Software Support Enhanced, the recommended level, consistent across all endpoints. Later growth goes through Change Subscription — never a second subscription, since each customer may hold only one.
Where to source
Most failed ISE orders come from the quiet rules — one subscription per customer, sizing to peak concurrent endpoints, one consistent support level, and reserving each tier separately under SLR. Validate the BOM against the official licensing tables before it reaches Cisco Commerce. ITMall engineers review Cisco ISE subscription license product page on ITMall configurations before quoting — see the full specifications for tier sizing and subscription pricing, or browse the current catalog at ITMall.
Source: this is an original guide rewritten from Cisco's official Cisco ISE Licensing Guide (no copyright year was shown in the fetched page text). Sourcing: https://www.itmall.sale/.