Cisco Identity Services Engine is a powerful solution for controlling who and what gets access to a network. While its technical capabilities are widely discussed, the licensing model often receives less attention, despite being one of the most important considerations when planning a deployment. Understanding the structure of Cisco ISE’s licensing is not just helpful—it’s essential. Without the correct licenses, even a well-designed ISE deployment will fail to function as intended.
In modern IT environments, licensing is more than just a contractual obligation. It affects architecture, scalability, and even day-to-day network operations. Cisco ISE’s licensing model includes a range of license types, each activating specific capabilities. Getting these right means aligning technical requirements with financial and administrative constraints.
This part of the series aims to break down the structure and philosophy behind Cisco ISE licensing. We will begin by looking at the two high-level license categories: node licenses and endpoint licenses. From there, we’ll examine the unique characteristics and practical applications of each type.
The Role of Node Licenses
Node licenses are relatively easy to grasp. These licenses apply to the infrastructure itself—the Cisco ISE servers or virtual appliances that run the various ISE personas, such as the Policy Administration Node (PAN), Policy Service Node (PSN), and Monitoring Node (MnT). Node licenses are perpetual, meaning they do not expire after a set period.
Unlike endpoint licenses, node licenses are fixed and tied to the quantity of deployed ISE nodes. If you are running Cisco ISE on a Cisco Secure Network Server appliance, no appliance license is needed. However, if the deployment uses virtual machines, an appliance license becomes mandatory.
The simplicity of node licensing makes it easy to plan for in advance. Once an organization has selected its ISE deployment model, the number of required nodes can be estimated with a fair degree of certainty. This allows planners to acquire the correct number of appliance and device administration licenses during the initial procurement cycle.
Appliance License in Virtual Environments
When ISE is deployed as a virtual machine, the appliance license becomes a requirement. Cisco defines three sizes for virtual appliances: small, medium, and large. Each corresponds to specific hardware resource allocations. The small license is meant for low-volume deployments or testing environments, while the medium and large licenses are better suited for production environments with hundreds or thousands of users.
The decision between small, medium, or large is determined by the VM’s configuration—specifically, the number of allocated CPUs and the amount of memory. It is important to note that licensing is tied to what you intend to run, not just what is currently configured. Purchasing a large license allows you to run a smaller VM, but not the reverse.
This licensing structure ensures that performance and scalability are in line with expected usage. Under-sizing a virtual appliance can lead to degraded performance, while over-licensing can lead to unnecessary cost. Therefore, correctly sizing your virtual appliances upfront is both a technical and financial consideration.
Device Administration and TACACS+ Licensing
Device Administration refers to the capability of Cisco ISE to perform centralized administrative access control for network infrastructure devices such as switches, routers, and firewalls. This is accomplished using the TACACS+ protocol.
To activate this feature, each Policy Service Node handling TACACS+ sessions must be licensed with a Device Administration license. This license is only required if TACACS+ is being used in the environment. If RADIUS is the sole method for user or endpoint authentication, Device Administration licenses are not necessary.
One unusual aspect of Device Administration licensing is that Cisco requires a minimum of 100 base endpoint licenses to be present in the system, even though those base licenses are not consumed during TACACS+ operations. This rule has no technical justification—it is a policy requirement, not a functional dependency. Nevertheless, it must be adhered to in order to activate Device Administration functionality in Cisco ISE.
This requirement often surprises organizations that are using Cisco ISE exclusively for administrative control over infrastructure devices. Even in those cases, a base endpoint license pool must be available, adding to the overall licensing cost.
Introduction to Endpoint Licenses
Endpoint licenses are where the complexity of Cisco ISE licensing really begins. These licenses are tied to the devices (endpoints) that are connecting to the network. They are allocated dynamically and are consumed during active sessions. An endpoint license is not assigned permanently to a device. Instead, it is checked out when a session begins and released when the session ends.
The licensing structure includes three endpoint license types: Base, Plus, and Apex. Each license unlocks specific features and capabilities within the Cisco ISE platform. Base licenses are mandatory and form the foundation of any ISE deployment. Plus and Apex licenses are optional and add advanced features on top of the base functionality.
The key point here is that licensing is feature-driven. An organization must match its desired feature set with the appropriate license type. For example, if device profiling or BYOD onboarding is required, Plus licenses must be purchased. If device posture checks or MDM integration are required, Apex licenses become necessary.
Endpoint License Allocation During Network Sessions
Cisco ISE allocates endpoint licenses based on the activity of connected devices. When a device connects to the network, the access switch, wireless controller, or VPN gateway sends RADIUS accounting messages to Cisco ISE. These messages mark the beginning and end of a session. During this time, Cisco ISE dynamically assigns the necessary license type(s) based on the policy matched.
A device will always consume a Base license during a session. If the matched policy includes profiling conditions, a Plus license is added. If it includes posture conditions, an Apex license is added. In some cases, all three licenses may be allocated for a single device, depending on the complexity of the authorization policy.
This mechanism means that license consumption is driven not just by the number of endpoints but also by the design of the authorization policies. A poorly designed policy could inadvertently trigger additional license types and increase the cost of operation without delivering any real benefit.
Understanding License Pooling and Reuse
Since licenses are allocated on a per-session basis, they are not permanently assigned to individual endpoints. Instead, they reside in a shared pool and are checked out temporarily. This allows for efficient reuse of licenses across shift workers, guest devices, and intermittently connected endpoints.
However, this also means that sizing the license pool correctly is a critical exercise. Organizations must forecast the peak number of concurrently connected endpoints across all use cases. If the number of active sessions exceeds the number of available licenses, new connections may be denied, or advanced features may become unavailable.
To make this estimation more accurate, historical usage data can be reviewed. Cisco ISE includes dashboards and reports that provide insight into license usage trends over time. These tools are essential for avoiding both over-licensing and under-licensing scenarios.
Licensing Impact on Policy Design
The design of authorization policies directly influences license consumption. For instance, if a policy includes a condition that checks for a device’s operating system using profiling, that session will require a Plus license. If the policy then also checks for antivirus status through posture assessment, it will require an Apex license as well.
This dynamic encourages thoughtful policy design. Rather than including all possible checks in every policy, organizations should evaluate which features are truly necessary for specific endpoint groups. By limiting the use of profiling and posture checks to only those groups that require them, it is possible to reduce the number of Plus and Apex licenses needed.
Such an approach not only lowers costs but also simplifies policy management. It helps ensure that the ISE system remains maintainable and efficient over time, especially as the number of connected devices grows.
Challenges in Estimating License Needs
One of the biggest challenges when planning a Cisco ISE deployment is estimating how many of each license type will be needed. While Base licenses are easier to plan for based on expected concurrency, Plus and Apex licenses require a more nuanced understanding of the authorization policies and endpoint types.
It is also important to consider that the same endpoint may consume multiple licenses during a single session. This is particularly true in environments where BYOD devices and corporate devices coexist, or where VPN users require advanced security checks.
Organizations that fail to account for these factors often find themselves needing to purchase additional licenses after deployment. To avoid this, it is strongly recommended to perform a pilot deployment or lab simulation to observe real-world license consumption patterns before scaling out the solution.
Cisco ISE Endpoint License Tiers – Base, Plus, and Apex
Cisco ISE’s endpoint licensing model is structured around three tiers: Base, Plus, and Apex. Each tier grants access to a progressively richer set of features. Understanding what each tier enables is essential for designing a secure and scalable network access control solution. The licensing tiers are not cumulative in a technical sense, meaning that a Plus license does not inherently include the features of a Base license, nor does Apex include Plus or Base. Instead, each license is assigned and consumed independently based on the features triggered during a session.
The decision to include features like device profiling, BYOD onboarding, or posture assessment drives the need for Plus and Apex licenses. Many organizations over-license because they fail to align feature requirements with policy design. Conversely, some organizations under-license, which can result in service failures or diminished functionality. This part focuses on providing a clear understanding of what each license tier offers and how those features map to practical use cases.
Base License Overview and Features
Base licenses are the foundation of any Cisco ISE deployment. These licenses are required for all endpoints that connect to the network and are authenticated or authorized by Cisco ISE. Without base licenses, endpoints cannot be admitted into the network. Because of this fundamental requirement, base licenses are not optional and must be part of every deployment.
These licenses are perpetual and allocated on a per-session basis, based on concurrent endpoint connections. They enable core authentication and authorization services that support both 802.1X and non-802.1X environments. Below are the key capabilities enabled by the base license.
Wired and Wireless Network Access Control is the primary use case. Base licenses allow endpoints to authenticate via RADIUS, which supports a variety of methods including EAP-TLS, PEAP, and MAC authentication bypass (MAB). These authentication methods form the backbone of secure network access.
Guest Portal Access is another included feature. Base licenses allow organizations to deploy a customizable web portal for guest users to self-register or be sponsored. This feature includes capabilities for timed access, approval workflows, and guest user lifecycle management.
Basic Authorization Policies are also enabled at the base tier. These policies control VLAN assignment, downloadable ACLs, and other session-level enforcement decisions based on identity, time of day, or other attributes.
Security Group Tagging (SGT) allows Cisco ISE to tag endpoints with classification metadata, which can then be used for scalable group-based access control in Cisco TrustSec-enabled environments. This feature supports micro-segmentation and is critical for zero trust initiatives.
Passive Identity (PassiveID) is available for Cisco switches. It allows ISE to monitor traffic and infer user identity and location without requiring active authentication. This is useful for visibility in environments where authentication is not enforced for every endpoint.
Base licenses provide enough functionality for a large portion of organizations. Many deployments that focus solely on authentication and access control without advanced profiling or compliance checks can be fully supported with only base licenses.
Plus License Capabilities and Use Cases
Plus licenses enable features that extend the functionality of Cisco ISE beyond authentication and access control. These licenses are subscription-based and must be renewed according to the organization’s licensing agreement. They are triggered when a policy references features such as device profiling, integration with location services, or context sharing with external systems.
Device Profiling is one of the most commonly used features enabled by Plus licenses. Cisco ISE can automatically identify endpoint types by analyzing DHCP fingerprints, MAC addresses, and other observable characteristics. This is especially valuable in environments with a wide range of unmanaged or headless devices, such as printers, IP phones, and cameras.
The Profiler Feed Service provides continuous updates to the profiling database. This ensures that ISE can correctly identify newly released devices and operating systems. This cloud-based service helps organizations stay ahead of changes in endpoint types and behavior.
BYOD Onboarding is a major capability at this tier. It enables self-service registration and onboarding of user-owned devices. This includes provisioning of certificates, device registration, and installation of network access policies. The onboarding workflows reduce the need for IT intervention and ensure compliance with organizational standards.
pxGrid Context Sharing allows Cisco ISE to share identity and session context with third-party systems. This capability is central to integration with other security platforms, including SIEMs, firewalls, and endpoint protection tools. pxGrid can be used to dynamically update network policies in response to changes in endpoint state or user behavior.
Location-based Access Control is another powerful feature. Integration with Cisco CMX or MSE allows policy enforcement based on a device’s physical location within a facility. This can be used to restrict access to sensitive resources based on proximity or implement contextual policies for compliance purposes.
Rapid Threat Containment, when used at the Plus tier, allows Cisco ISE to initiate threat mitigation actions based on context provided by integrated security tools. These actions can include session termination, VLAN changes, or quarantine actions in response to detected threats.
PassiveID for non-Cisco switches extends the visibility features to environments that do not exclusively use Cisco switching infrastructure. This is important for hybrid environments that include multiple vendors in the access layer.
Organizations with a diverse device landscape or with BYOD requirements often find that Plus licenses are necessary to achieve adequate visibility and control. However, these features should be applied strategically to avoid unnecessary license consumption.
Apex License Features and Compliance Focus
Apex licenses represent the highest tier in the Cisco ISE licensing model. Like Plus, Apex licenses are subscription-based and must be kept current for their features to remain active. These licenses enable advanced security capabilities that are centered around endpoint compliance and integration with mobile device management solutions.
Device Posturing is the cornerstone feature of Apex. Posturing involves scanning the endpoint to assess its compliance with organizational policies. This can include checking for antivirus presence and status, verifying operating system patch levels, and ensuring that specific applications are installed or up to date. Posturing can trigger remediation actions if the endpoint is found to be non-compliant.
Posture Policy Enforcement uses the results of the posturing scan to assign appropriate authorization levels. For example, compliant devices may receive full access to internal resources, while non-compliant devices are placed in a remediation VLAN with limited internet access. This real-time policy adjustment enhances security without requiring manual intervention.
MDM Integration allows Cisco ISE to query external mobile device management systems for additional context about mobile endpoints. This can include device compliance status, enrollment verification, and the presence of required security applications. This capability is especially important in environments where mobile devices play a central role in daily operations.
Rapid Threat Containment at the Apex tier integrates with advanced security systems to isolate infected or compromised endpoints. In this context, the containment action is based on posturing results or external threat intelligence. This integration supports an adaptive security posture and aligns with zero trust architectures.
Use cases for Apex licenses are typically found in highly regulated industries or environments with strict security requirements. Financial services, healthcare, and government organizations often require endpoint compliance validation before granting access to sensitive systems.
It is important to note that Apex features are applied selectively. Not all endpoints need to be postured or managed via MDM. By designing targeted authorization policies, organizations can reserve Apex licenses for high-risk scenarios or user groups, thereby managing costs while maintaining robust security.
Feature Separation and License Independence
A key architectural principle in Cisco ISE is that licenses are functionally independent. This means that activating Plus or Apex features does not automatically activate Base functionality. Each license type is checked independently based on the attributes referenced in the authorization policy. If a policy includes only posturing checks, but the base license is unavailable, the session will still be denied.
This separation allows for flexible policy construction but also demands careful license management. Policies must be aligned with available license capacity to avoid unintentional service interruptions. Cisco ISE’s reporting tools can help administrators understand which license types are being allocated and under what conditions.
Additionally, a single endpoint session may consume all three license types if the policy references features across tiers. For example, a laptop that is profiled during authentication, postured for antivirus, and authenticated via 802.1X would allocate a Base, Plus, and Apex license simultaneously.
Understanding this behavior is vital to accurately forecasting license needs and preventing overuse or underutilization of available licenses.
Practical Deployment Scenarios
To illustrate how the different license tiers are used in practice, consider the following deployment examples:
In a university campus environment, students connect their personal devices to the network. These endpoints are profiled automatically, onboarded through self-service portals, and verified for antivirus compliance. This setup uses all three license tiers, with Plus enabling profiling and onboarding, and Apex ensuring compliance.
In a financial institution, all endpoints are corporate-issued and subject to strict compliance policies. Devices are authenticated via certificates and undergo posturing checks before being granted access to the internal network. Apex licenses are heavily used here, while Plus may not be necessary.
In a manufacturing facility, the network includes many unmanaged devices such as cameras, sensors, and industrial control systems. These devices do not support 802.1X, so MAC authentication bypass is used. Device profiling helps classify and authorize these endpoints, making Plus licenses essential, while Apex is not required.
These scenarios demonstrate that different environments call for different licensing strategies. The key is to map business and security requirements to the features that each license tier provides, then size the license pool accordingly.
Avoiding Common Licensing Pitfalls
One common mistake is enabling all features globally without understanding the licensing implications. This leads to unintentional license consumption and often surprises organizations with inflated subscription costs. Another issue is failing to reassess licensing needs as the network evolves. Changes in policy, device types, or user behavior can all affect license usage.
It is recommended to build and test policies in a lab environment, using a representative set of endpoints and network devices. Cisco ISE’s built-in license usage reports can then be used to validate assumptions before going live.
Ongoing monitoring of license consumption should be part of the operational process. If trends show increasing usage of Plus or Apex features, budget planning should be adjusted to account for upcoming subscription renewals.
How Cisco ISE Endpoint Licenses Are Allocated and Released
Cisco ISE uses a dynamic license allocation model, meaning that licenses are not statically assigned to individual devices but are temporarily consumed during active network sessions. The lifecycle of a license begins when an endpoint initiates a connection and ends when that session is closed. This method supports efficient use of licenses, especially in environments with a rotating or transient population of devices, such as in campuses, hospitals, or remote workforces.
Understanding this allocation and release process is crucial for managing concurrency. Licensing in ISE is not about the total number of devices in an organization but about the number of devices connected at the same time. That’s the key metric for calculating the required license pool.
Cisco ISE relies heavily on RADIUS accounting messages and policy outcomes to determine which licenses to allocate and when. This part focuses on how these messages are interpreted and how ISE determines what licenses are consumed for each session.
RADIUS Session Establishment and License Triggering
When an endpoint connects to a network, a RADIUS authentication and accounting flow begins between the access device (like a switch or wireless controller) and Cisco ISE. The process includes several messages, but for licensing purposes, the key ones are:
- Accounting Start: Signals the beginning of a session. This is the trigger point where ISE allocates licenses.
- Accounting Interim-Update: Used for ongoing session updates. This keeps the session alive and helps track usage.
- Accounting Stop: Signals the end of a session. This triggers license release.
Once a RADIUS Accounting Start is received, ISE evaluates the session and determines which licenses are necessary based on the matched authorization policy. Each authorization policy can reference multiple attributes, such as profiling data or posture assessment status. The presence of these attributes triggers allocation of Plus or Apex licenses, in addition to the mandatory Base license.
This event-driven behavior means that licenses are not consumed simply because a device appears in the network or receives an IP address. They are only consumed once a full RADIUS transaction is completed and an authorization decision is rendered.
License Release and Session Termination
When a device disconnects from the network, or its session is otherwise terminated, the access device sends a RADIUS Accounting Stop message to ISE. This marks the end of the network session and releases any licenses that were allocated for that device.
In environments where devices frequently connect and disconnect, such as wireless or VPN deployments, this system works efficiently to recycle licenses. However, in poorly configured networks, missing or delayed accounting stop messages can lead to licenses being held longer than necessary. This can result in apparent license overuse, even though the actual number of active devices is within the license limits.
For this reason, it is important to ensure that all access network devices are configured to send both start and stop accounting messages reliably. The license count displayed in the ISE dashboard is based entirely on these messages, so their accuracy directly affects reporting and capacity planning.
Concurrency and License Sizing
Cisco ISE licensing is based on concurrent usage, not on total endpoints registered or connected over time. This means that if an organization has 50,000 endpoints but only expects 10,000 to be connected at the same time, it only needs licenses to support those 10,000 concurrent connections.
This concept makes ISE licensing more flexible than traditional per-device licensing models, but it also introduces the challenge of estimating peak concurrency accurately. Underestimating concurrency can lead to sessions being denied or degraded. Overestimating can result in unnecessary licensing costs.
To plan properly, organizations must analyze network usage patterns, consider peak times such as start-of-day login storms or scheduled software updates, and account for both human and machine endpoints. ISE’s historical license usage reports can provide a baseline, but initial sizing often requires traffic modeling and analysis of existing infrastructure logs.
How Policy Matching Affects License Allocation
The specific authorization policy matched during the session dictates whether only a Base license is required, or if Plus and/or Apex licenses are also allocated. Policies in Cisco ISE can be constructed to use conditions based on user identity, endpoint type, location, posture status, device profile, or external attributes.
If a policy includes attributes derived from device profiling (e.g., “endpoint type is Apple iPhone”), a Plus license is required. If the policy includes posture attributes (e.g., “anti-malware status is compliant”), then an Apex license is added. If both are included, all three licenses will be allocated during the session.
This mechanism allows for flexible licensing tailored to specific use cases. For example, guests connecting via a captive portal may only need Base licenses. Corporate laptops may need Base and Plus, and contractors connecting over VPN with compliance checks may consume all three.
The downside of this flexibility is that poorly constructed policies can unintentionally increase license consumption. Including profiling and posture conditions in general-purpose policies means that every device matching those policies will require Plus or Apex licenses, even if the checks are unnecessary for that user group.
Policy Design Tips for License Optimization
To prevent wasteful consumption of licenses, administrators should design policies to apply advanced checks only when needed. A tiered approach is often effective, where basic users receive minimal policy checks and only higher-security groups trigger advanced profiling or posture assessment.
Here are some strategies for minimizing unnecessary license usage:
- Segment authorization rules by user or device group so that only critical endpoints receive profiling or posture checks.
- Use identity groups to apply stricter controls only to high-risk users such as contractors or remote workers.
- Avoid default policy rules that include Plus or Apex conditions unless absolutely required.
- Build test policies in parallel and measure license usage in a lab or limited production pilot before full rollout.
By refining policy logic and regularly reviewing authorization conditions, organizations can often reduce the number of Plus and Apex licenses needed without compromising security.
Session Duplication and Multiple License Allocation
One endpoint may generate more than one session if it connects through multiple interfaces or if the network topology causes duplicate accounting messages. For example, a laptop connected to both wired and wireless networks will typically establish two sessions and may consume two Base licenses simultaneously.
This behavior must be considered when calculating license pool requirements. Modern usage patterns, such as users docking laptops while maintaining wireless connections, or split-tunnel VPN configurations, can significantly affect concurrency.
Cisco ISE attempts to correlate sessions from the same endpoint and user, but the accuracy depends on how consistent device identifiers are across interfaces. Enabling session correlation in the policy can help, but it’s not always possible to merge sessions perfectly, especially in environments with high mobility or multiple authentication paths.
To account for this, organizations should include a buffer in their license estimates. A conservative approach includes 10 to 20 percent above the peak observed concurrent session count to accommodate fluctuations and duplicate sessions.
Troubleshooting License Allocation Issues
When license consumption appears higher than expected, it’s important to first verify that accounting messages are functioning properly. Incomplete or inconsistent accounting data is one of the most common causes of incorrect license counts.
Next, administrators should review the authorization policies to see which features are in use and whether those features require Plus or Apex licenses. ISE provides per-session license allocation details in its Live Sessions view and licensing reports.
The following checks can help pinpoint the source of over-consumption:
- Confirm that accounting stop messages are being received from all access devices.
- Check for duplicate sessions caused by wired/wireless or VPN overlap.
- Audit policy conditions for unintentional use of profiling or posture attributes.
- Review the Profiler Feed and Posture Feed configurations to ensure they are only enabled where necessary.
Addressing these issues often results in immediate recovery of license capacity and improved visibility into actual consumption patterns.
License Visibility and Reporting
Cisco ISE provides built-in tools to track current and historical license usage. These tools are accessible from the Primary Administration Node under the Licensing section. Administrators can view the number of active sessions per license tier, usage trends over time, and sessions by node or endpoint type.
The real-time license usage chart displays the current number of Base, Plus, and Apex licenses in use. Historical graphs show how usage changes throughout the day, week, or month, allowing for trend analysis and future planning.
These tools are essential for auditing compliance, preparing for audits, and managing growth. They also help detect anomalies such as sudden spikes in usage, which might indicate policy misconfigurations or unauthorized activity.
ISE also allows exporting usage data for external analysis. This can be useful for organizations with centralized IT reporting or those that wish to correlate license usage with other infrastructure metrics.
Planning and Calculating Cisco ISE Endpoint License Requirements
Accurate license planning is fundamental to a successful Cisco ISE deployment. Poor planning can lead to either under-licensing, which disrupts operations, or over-licensing, which inflates costs unnecessarily. Unlike static license models, Cisco ISE’s dynamic and concurrent license allocation system requires a different mindset. Estimating how many Base, Plus, and Apex licenses an organization will need involves understanding the behavior of users, devices, policies, and infrastructure.
In this section, the focus is on translating technical architecture and usage patterns into license quantities. We explore planning methodologies, practical estimation techniques, and the tools available in Cisco ISE to validate assumptions and adjust licensing strategy over time.
Starting With a Network Inventory
A comprehensive inventory of users and devices is the logical starting point. This includes:
- Total number of endpoints (laptops, phones, printers, IP phones, cameras, etc.)
- User roles (employees, guests, contractors, students, etc.)
- Device ownership (corporate-managed, BYOD, unmanaged)
- Access types (wired, wireless, VPN)
- Authentication methods in use (802.1X, MAB, web auth)
Once this information is gathered, break it down into endpoint categories. For each category, determine whether profiling, posture, or both will be required. This defines the license tier necessary for that group.
For example:
- Corporate laptops using 802.1X only: Base
- BYOD smartphones using profiling: Base + Plus
- Contractor VPN clients with posture: Base + Apex
- Guest web-auth users: Base only
This categorization enables targeted planning and avoids blanket licensing for features that are not universally required.
Understanding Usage Patterns and Concurrency
Concurrency is the key driver of license quantity. Cisco ISE licensing is not based on the total number of devices that might connect, but on how many are connected at the same time. This requires understanding the network’s peak load.
Analyzing network logs, switch port utilization, WLAN controller reports, and VPN usage statistics can help identify peak concurrent sessions. This data should be analyzed over several weeks to identify patterns such as morning login spikes, lunch break disconnections, or after-hours maintenance activity.
A few concurrency scenarios:
- Office buildings often peak during standard business hours.
- University campuses may have highly variable patterns, especially during class changes.
- Hospitals may have consistent 24/7 concurrency due to shift work and always-on medical devices.
- Remote work environments may have higher VPN concurrency during business hours, especially on Mondays and Fridays.
Planning must account for the highest expected concurrency, not the average. It’s also wise to add a buffer (typically 10–20%) for unexpected usage spikes, future growth, or temporary license failures.
Sample License Calculation
Consider an environment with the following attributes:
- 6,000 corporate laptops using 802.1X (Base only)
- 3,000 headless IoT devices using MAB with profiling (Base + Plus)
- 1,000 contractor VPN users that require posture validation (Base + Apex)
- 500 concurrent guests using web auth (Base only)
- Assumed 80% peak concurrency for employees and guests, 100% for contractors and IoT
The calculation would be:
Base licenses
- 6,000 x 0.8 = 4,800
- 3,000 x 1.0 = 3,000
- 1,000 x 1.0 = 1,000
- 500 x 0.8 = 400
Total = 9,200 Base licenses
Plus licenses
- 3,000 x 1.0 = 3,000
Total = 3,000 Plus licenses
Apex licenses
- 1,000 x 1.0 = 1,000
Total = 1,000 Apex licenses
In this scenario, the organization should plan for:
- 9,200 Base licenses (perpetual)
- 3,000 Plus licenses (subscription)
- 1,000 Apex licenses (subscription)
This calculation should be reviewed quarterly or when significant changes occur (e.g. mergers, remote work shifts, or security policy updates).
Interpreting License Usage Reports in Cisco ISE
Cisco ISE provides two major reporting views to help track license usage:
Current Usage View
This displays how many licenses are currently in use by type (Base, Plus, Apex). It reflects real-time session activity and is useful for confirming if usage aligns with estimates.
Usage Over Time View
This chart provides historical data that helps identify trends. Hovering over specific time points reveals exact session counts by license type. It’s valuable for capacity planning and forecasting future requirements.
In environments using Smart Licensing, Cisco ISE can report usage directly to Cisco’s Smart Account portal, where long-term tracking and license pooling across multiple deployments is available. This provides a broader view for organizations with global or multi-site operations.
Factoring in Session Duplication
It is common for a single endpoint to generate more than one session, especially when using dual interfaces. A laptop connected to both wired and wireless at the same time, or a VPN client with a split tunnel, may show up as two concurrent sessions. Each session consumes a Base license and, depending on policy, may also consume Plus and Apex.
Organizations should factor this behavior into planning by:
- Tracking the percentage of users likely to dual-connect
- Estimating how many of those dual sessions overlap in time
- Applying a buffer to the license count accordingly
Some organizations handle this by assuming that 10–15% of users will have overlapping sessions. Others use session correlation features to reduce duplication, though correlation is not always perfect and may not apply across different authentication domains (e.g. wired and VPN).
Planning for Bursting and Growth
License planning should accommodate short-term usage spikes and long-term growth. Bursting can occur during events like network cutovers, mass re-authentication, software rollouts, or changes in guest traffic. Growth comes from increased headcount, additional facilities, new devices, and policy expansion.
Best practices for handling this include:
- Adding 15% headroom to all calculated license counts
- Reviewing usage monthly for any deviations from expected patterns
- Setting alerts in ISE or the Smart Account portal when usage approaches thresholds
- Performing annual or semi-annual audits to revalidate license needs
This helps prevent surprises, especially for subscription licenses (Plus and Apex), which require renewals and are subject to compliance enforcement.
License Management with Smart Licensing
Smart Licensing enables centralized management and automatic reporting of license usage. While optional for now, Cisco is steadily moving all software products to this model.
Benefits include:
- Real-time usage visibility across multiple ISE deployments
- Central tracking of entitlements and renewals
- Easier transfer of unused licenses between systems
- License pooling for enterprise agreements
Administrators must register each ISE deployment with the Smart Licensing system. For offline environments, Cisco provides a satellite server option. Once registered, license usage data is automatically uploaded and can be viewed in the web portal.
However, Smart Licensing requires outbound internet access or regular manual synchronization. Organizations with strict network controls must design workflows for exporting and importing license usage data on a recurring schedule.
Licensing Considerations for Mergers, Expansion, and Cloud
As organizations expand, merge, or shift to hybrid/cloud infrastructure, license requirements change. New sites mean more endpoints. Remote work means more VPN usage. Cloud-hosted ISE nodes may introduce different session handling patterns.
In these scenarios, license forecasting must include:
- Growth of concurrent user base
- Shifts in policy enforcement (e.g. more posture checks due to remote access)
- Changes in session duration and frequency
- Need for regional license allocation or pooling
ISE deployments across multiple geographic regions can still share licenses via Smart Licensing, allowing more efficient distribution. For example, a low-usage region can temporarily lend licenses to a high-usage one.
However, in disconnected or siloed deployments, licenses must be provisioned independently, often with added buffer due to lack of centralized visibility.
Steps to Maintain License Compliance
Ongoing compliance requires a few operational habits:
- Regularly review live session and usage reports
- Audit policy configurations for license-tier dependencies
- Validate that network devices are properly sending accounting start and stop messages
- Ensure Smart Licensing synchronization is working if enabled
- Confirm subscription license expiration dates and renew early
Organizations should also maintain a mapping of policies to license requirements. As new features or devices are introduced, the impact on licensing should be documented and reviewed.
Avoid assuming that new policies will be covered by existing license pools. For example, adding posture checks to a general user policy will instantly increase Apex license usage across the organization if not scoped correctly.
Calculating endpoint license requirements in Cisco ISE is a structured process that begins with network inventory, continues through concurrency analysis, and ends with policy alignment. Real-world scenarios, such as hybrid work or IoT adoption, add complexity, but the tools and reports in ISE provide a solid foundation for accurate planning.
With a well-designed licensing strategy, organizations can avoid both under-utilization and unexpected overages, ensuring they get the most value from their Cisco ISE deployment while maintaining full compliance.
Final Thoughts
Licensing is rarely anyone’s favorite topic, but in the context of Cisco Identity Services Engine, it’s more than just a contractual necessity. It’s a foundational part of how the platform is architected, deployed, and ultimately delivers value. The goal of this series has been to demystify Cisco ISE’s licensing model and provide practical guidance to help you avoid the common pitfalls that catch even experienced engineers off guard.
Understanding the structure—divided between node and endpoint licenses—is just the starting point. Where the model becomes truly nuanced is in how endpoint licenses are dynamically allocated and released based on real-time session activity and policy decisions. The Base, Plus, and Apex tiers are not just marketing bundles—they are technical enablers that directly map to the features your policies invoke.
Planning for ISE licensing is not a static process. It evolves with your network. New authentication methods, growing endpoint diversity, hybrid access scenarios, regulatory compliance demands—each one has the potential to affect your license consumption. It’s for this reason that visibility, monitoring, and periodic audits are essential operational practices.
More than anything, the key takeaway is that licensing cannot be an afterthought. It must be part of the design conversation from the beginning, alongside hardware sizing, redundancy, policy framework, and security strategy. When treated with the same attention to detail, licensing becomes less of a constraint and more of a planning tool that helps align technical goals with business realities.
If you’re deploying Cisco ISE—or expanding an existing deployment—approach licensing with the same diligence you’d apply to designing high-availability infrastructure or zero trust policy enforcement. The effort will pay dividends in operational stability, predictable costs, and smoother growth down the line.