NSA Licensing/Subscription
Licenses/subscriptions are added to your NSA by Ivanti.
The Subscriptions page displays the licenses/subscriptions that are active on your NSA. To access this page, click Administration > Subscriptions.
The Summary page displays for each subscription/license:
- License/Subscription high-level details, including dates and Users and Features license usage metrics.
- Subscription license expiration notification for due in 90 days, 30 days, 15 days, 7 days, and 1 day, and Grace period notification for 30 days, 15 days, 7 days and 1 day. Email notification also will be sent regarding the license expiration and Grace period.
- One or more descriptions of the features in the license/subscription. Where there are multiple features, use Previous / Next to navigate.
When any defined limit on the license/subscription is met, a message appears:
- At 75% utilization of seats, an information message appears at the bottom of the screen. You can optionally click Close.
- At 90% utilization of seats, a modal message appears at login. Click Dismiss to clear the message.
- When 25% of the duration of the license/subscription remains, a modal message appears at login. Click Dismiss to clear the message.
The Users page lists users and their devices registered on NSA.
The Feature Licenses page lists users and gateways with Advanced HTML5 feature license registered on NSA. Feature license is supported for ICS Gateways version 22.7R2.9 and above.
Named User Licensing Normalization
NSA named user licensing normalization feature allows a user to use different login formats - Domain\username, Common Name (CN), and User Principal Name (UPN) - from different devices, but consumes only one seat for the user. Single license is consumed instead of two through associating devices with users for Machine Cert Authentication and subsequent User Authentication. This feature is supported only for ICS 22.6R2 Gateway with ISAC 22.6R1 Client and later versions.
Device to User Normalization
When a device logs into an ICS Gateway, gateway checks if device entry exists in the local gateway cache.
- If device entry exists in gateway cache, device login is successful. Then request will not go through NSA, but will be handled in ICS Gateway.
- If device entry does not exist in gateway cache, gateway sends request to NSA to reserve a valid license.
- If this device login is for the first time, Device name and Device serial number are sent to NSA. This map is updated in NSA for reserving license for device first.
- If user login is from the registered device, NSA verifies Device serial number entry mapping and recognizes an existing map for that serial number with device.
- Device serial number map is done irrespective of any gateway that user tries to log in. - User to device mapping from gateway is updated in NSA as part of normalization.
Summary information for the NSA licenses/subscriptions is displayed at the top of the page:
- Total number of seats.
- Total number of issued named user license seats. Each of these is listed in the table below the summary.
- The percentage of seats consumed.
For each named user, the following information is displayed:
- The name of the user.
- The gateways enrolled for that user.
- First and Last login times. Use the arrow icon to toggle between ascending and descending order.
- The status of the named user license seat of that user.
The First login time and Status columns are not displayed by default. Use the Advanced filter icon to add these columns.
Login type | Authentication type | Subscription page User details |
|---|---|---|
L3 Login | Machine Auth enabled with latest client 22.7R3-30227 | Device details updated |
L3 Login | Machine Auth not enabled | Device details is blank |
L3 Login | User Auth enabled | Device details is blank |
L7 Login | Machine Auth enabled with latest client 22.7R3-30227 | Device details is blank |
L7 Login | User Auth enabled | Device details is blank |
You may need to remove users when there is any changes in the organization. To delete one or more named users, select the corresponding check boxes and click Delete.
You may want to automatically remove the license of users/devices who have not logged-in in the last 30 days. To delete those users/devices automatically, select the Auto Delete check box. Every time the Auto Delete process deletes users/devices, a corresponding "Auto Delete" message (with message ID, such as ADM32451/SYS32452) is created in the admin logs, thus providing visibility into how many and which licenses were deleted over a specified period.
The counts in the Users page, and information in the Summary page get updated accordingly.
Feature Licenses
The Feature Licenses page lists users with Advanced HTML5 feature license registered on NSA.
- NSA supports Advanced HTML5 feature license on ICS Gateways with version 22.8 and 25.x. - NSA supports AI Chatbot and Threat Neutralizer subscription-based feature licenses on ICS Gateways 25.x.
Summary information for the NSA licenses/subscriptions is displayed at the top of the page:
- Total number of licensed seats.
- Total number of users to whom license is issued. Each of these is listed in the table below the summary.
- The percentage of seats consumed.
- A table listing users, gateway they belong to, their session ID, and License start date and time.
- Click the arrow icon adjacent to the column name to sort in ascending or descending order.
- In the Search field on Filter bar, type the username for which you want to see the corresponding Gateway, session ID and other details.
- Use the Group by option and select the field type to view the table information in groups.
- Use the Advanced filter option to create a filter and then apply the filter to narrow down the displayed entries to a sub-set that matches the filters you apply.
To enable feature license for a Gateway:
- From the Gateways > Gateways List page, click on the required Gateway link (ICS Gateway's version should be 22.7R2.9).
- From the gateway drop-down, select System > Configuration > Licensing.
- In the Licensing Summary page, select NSA Named User Licensing Mode, then select the Advanced HTML5 Licenses check box, and then click Save.
Grace Period Functionality for ICS Gateway
Grace period allows gateways to maintain connectivity for end users even when the NSA is temporarily unavailable. A grace period of 5 days is provided, during which new user logins can continue without interruption.
Important Note (ICS Gateway builds 25.1.0.0 and 25.1.0.1): If the connection between the gateway and nSA is lost, the grace period is not activated for new user logins. This means that users who attempt to log in after the connection has been lost will not be authenticated, and their login attempts will fail. The grace period only continues to apply for users who were already logged in before the disconnection occurred; their sessions remain unaffected. To allow new users to log in, restore connectivity between the gateway and nSA as soon as possible.
How it Works
New User Logins: Only new user license seat reservation requests are sent to the NSA.
Existing Users: Existing user sessions are managed using the local gateway cache, ensuring that they remain unaffected by NSA availability.
ICS Gateway versions prior to 22.7R2.2
The grace period is triggered based on the notification channel status:
Notification channel is Green: When the channel is reachable, the user license seat reservation request is sent to the NSA.
Notification channel is Red: When the channel is not reachable, the grace period is triggered to enable new user logins. During this time, no requests are sent to the NSA.
ICS Gateway versions 22.7R2.2 onwards
The grace period will now also be triggered if the user license seat reservation API fails. This ensures seamless operation even during temporary service disruptions, providing more robust support for user logins during such periods.