Grace Period
Grace period allows gateways to maintain connectivity for end users even when the NSA is temporarily unavailable. A grace period of 5 days is provided, during which new user logins can continue without interruption.
How it Works
New User Logins: Only new user license seat reservation requests are sent to the NSA.
Existing Users: Existing user sessions are managed using the local gateway cache, ensuring that they remain unaffected by NSA availability.
ICS Gateway versions prior to 22.7R2.2
The grace period is triggered based on the notification channel status:
Notification channel is Green: When the channel is reachable, the user license seat reservation request is sent to the NSA.
Notification channel is Red: When the channel is not reachable, the grace period is triggered to enable new user logins. During this time, no requests are sent to the NSA.
ICS Gateway versions 22.7R2.2 onwards
The grace period will now also be triggered if the user license seat reservation API fails. This ensures seamless operation even during temporary service disruptions, providing more robust support for user logins during such periods.
Grace Period Duration
Platform | Pulse Cloud Licensing Service (PCLS) | Licensing Server (LS) | Neurons Secure Access licensing mode | Grace period duration |
|---|---|---|---|---|
ISA-V / PSA-V with subscription licenses | Lost connectivity to PCLS | NA | NA | 24 days |
ISA-V / PSA-V / ISA / PSA | NA | Lost connectivity to LS | NA | 10 days |
ISA / ISA-V | NA | NA | Lost connectivity to Neurons Secure Access platform | * Existing Users continue to login. * New Users - 5 days grace period. |
Cluster Grace Period Duration
Platform | Cluster | Feature license | Grace period duration |
|---|---|---|---|
ISA / PSA / ISA-V / PSA-V | When a node fails what is the grace period for Concurrent Users | When a node fails what is the grace period for Concurrent Users | 10 days |
ISA / ISA-V | NA | NA | 10 days |
- Ivanti recommends using standalone nodes or clusters of a maximum of two nodes behind a load balancer. - Ivanti Security Appliance (ISA)/ISA-V does not support clusters containing more than two nodes for ICS.
Virtual License Server Grace Period Duration
ISA hardware or ISA-V running 22.1 and above can act as a licensing server; 22.x and later release supports leasing licenses through License Server. For a virtual license server deployment, a platform / core license is not required. Only a “license server” license is required. If the licensing server is deployed as part of a cluster, then only a single node requires the “license server” license.
Only a single node on the Licensing Server requires the concurrent users or feature licenses. If a node fails on the Licensing Server cluster, grace period is 20 days for which the other node can lease licenses both concurrent user and feature licenses.
Secure Access Platform Grace Period
Platform - Secure Access Platform | License expired / Grace period |
|---|---|
ZTA subscription license | No grace period |
ICS subscription license | 31 days |