Cisco ISE part numbers: subscriptions, VM and device admin licences

What you order for Cisco ISE

Cisco Identity Services Engine (ISE) is Cisco's network access control platform: it decides which users and devices may join the wired, wireless and VPN network, and what they can reach once connected. Cisco's ISE licensing guide (opens in a new tab) says a deployment has three parts: somewhere to run ISE (a physical appliance, a virtual machine or a cloud instance), the software licences and support. The licences come in three types:

ISE-SEC-SUB is ordered with a quantity of one, because each customer has one ISE subscription. The tier codes go under it. The tiers are nested: Advantage includes everything in Essentials, and Premier includes everything in both. All ISE licences are Smart Licences, held in your organisation's Cisco Smart Account and managed in Cisco Smart Software Manager; we can set the Smart Account up with you. See Cisco Smart Licensing (opens in a new tab) for how Smart Accounts work.

How Cisco ISE licensing works

ISE subscriptions are counted by active endpoints: the maximum number of devices you expect to be connected at the same time on any given day, not every device you own. Cisco measures this through RADIUS sessions, so a laptop counts while it is on the network and is released when its session ends.

• Minimum and quantity: any quantity from 50 endpoints upwards.
• Term: 1, 3 or 5 years, with 36 months as the default. Subscriptions can be co-termed, so ISE can line up with your other Cisco renewals.
• Start date: by default 3 days after the order, or any date up to 90 days ahead. Cisco suggests matching it to your hardware lead time so the term does not start before ISE is installed.
• Mixing tiers: each endpoint uses one licence of the highest tier its access policy needs. Cisco's own example is 1,000 active endpoints where 400 are matched on profiling attributes: that needs 600 Essentials and 400 Advantage licences.
• Support: Basic Support is included for the length of the subscription. Solution, Enhanced and Premium Support are paid upgrades, and the level applies to all your endpoints.
• Renewal: ISE subscriptions can be co-termed and renewed through us, with renewal options confirmed at quote.

The virtual machine and Device Admin licences are perpetual: you buy them once for each node. Every new ISE installation also starts with a 90-day evaluation covering 100 endpoints and all features, which is a useful way to size the deployment before you order.

The table lists the ISE licence part numbers. Add the ones you need to the basket and we confirm codes, quantities and terms when we quote.

Cisco ISE part numbers

Subscription and support codes run for the ISE term; the Device Admin and virtual machine licences are perpetual, bought once; the Route column shows how Cisco lists them.

Part numbers from Cisco ISE Licensing Guide (updated 7 July 2026) (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.

ISE appliances are quoted separately

ISE runs on Cisco Secure Network Server appliances, on your own virtual platform (VMware, Linux KVM, Hyper-V, Nutanix AHV or Red Hat OpenShift) or in Amazon Web Services, Microsoft Azure or Oracle Cloud. Physical appliances are hardware: if you want them, we size the appliance against your endpoint count and include it in the quote, with the model confirmed at quote.

Virtual and cloud nodes each need the virtual machine licence R-ISE-VMC-K9=. Older Small, Medium and Large virtual machine licences have been converted one for one to this common licence, so support renewals now use the same code.

Choosing an ISE tier

The tier depends on what your access policies use, according to Cisco's tier table:

• Essentials: authentication and authorisation with RADIUS, 802.1X, MAC Authentication Bypass and web authentication, guest access portals and Easy Connect.
• Advantage: adds device profiling, BYOD onboarding with a built-in certificate authority, pxGrid context sharing with other security tools, TrustSec group-based segmentation, Endpoint Analytics and Rapid Threat Containment.
• Premier: adds posture checks on device health, mobile device management compliance and threat-centric network access control.

Posture checks through ISE also need Cisco Secure Client Premier on the endpoint: see Secure Client Premier. For a fuller comparison of what each tier does, read Cisco ISE licensing (opens in a new tab) on our Cisco security site.

ISE in Cisco suites and services

You may already hold ISE licences through another Cisco purchase:

• Cisco security suites: for what each Cisco security suite includes, see Cisco security suites.
• Catalyst switching subscriptions: Cisco includes ISE Advantage licences with Catalyst Advantage for switching, in a quantity that depends on the switch. We check what your switches already include before we quote extra licences.
• Talos Incident Response: Cisco sells Talos Incident Response retainers that attach to an ISE order. See Cisco Talos.

ISE controls access to the network; Cisco Duo adds MFA to the applications people log in to, and the two are often bought together. For other identity products, see identity, MFA and privileged access.

How we help

Forever Systems, a Cisco Partner, sizes ISE against your real peak of connected devices, works out which endpoints need Advantage or Premier, and counts the virtual machine and TACACS+ licences your design needs. We can deploy ISE, connect it to your switches, wireless and VPN, and handle renewals and licence changes afterwards.

Add the codes you are interested in to the basket and send them with your enquiry; nothing is charged online. We confirm the codes, quantities and terms when we quote. Contact us to start.