Ivanti Connect Secure licensing covers the Ivanti Connect Secure (ICS) VPN gateway and its companion network access control product, Ivanti Policy Secure (IPS). Ivanti documents two licensing modes. In Gateway Licensing Mode concurrent users are counted on each gateway. In NSA Named User Licensing Mode, sold as the Unified Access License (UAL), named users are counted centrally in Ivanti Neurons for Secure Access (NSA).[1] Licences are keys installed on an appliance or leased from a license server. The software reports its licence state, which makes the product’s own licensing rules as important as the contract. The contractual basis is the EULSA, whose Concurrent User and Named User models match the two modes.[8] For the master agreement see Ivanti licensing.
Editions
The License Management Guide lists these licence types: CONSEC and POLSEC subscription and perpetual licences, CONSEC and POLSEC named subscription and perpetual licences, ACCESS subscription licences and feature licences.[5] Part numbers follow a pattern in which X is the user count and Z the number of years.[6]
| Licence | Catalog row | What it is |
|---|---|---|
| CONSEC-XU-ZYR | CONSEC-XU-ZYR | Connect Secure concurrent user count subscription[6] |
| POLSEC-XU-ZYR | POLSEC-XU-ZYR | Policy Secure concurrent user count subscription[6] |
| CONSEC-ADD-xU | CONSEC-ADD-xU | Perpetual concurrent user licence[5] |
| PSA-MTG-xU | PSA-MTG-xU | Perpetual meeting user licence[5] |
| ACCESS-1000U-1YR | ACCESS-1000U-1YR | Subscription whose capacity can be leased to any ICS or IPS gateway[6] |
| ACCESS-LICENSE-SVR, ACCESS-SUB-SVR-ZYR | ACCESS-LICENSE-SVR, ACCESS-SUB-SVR-ZYR | Needed for a hardware appliance to be recognized as a license server[5] |
| PSA-LICENSE-MBR | PSA-LICENSE-MBR | License Member licence for surrendering licences or leasing platform-specific perpetual licences[5] |
Subscription and renewal licences (a renewal carries a -R suffix) have start and end dates embedded. A renewal licence activates only when a matching subscription or renewal licence has expired.[6] Feature licences, such as Advanced HTML5, enable a function and may carry a user count. They can be subscription or perpetual.[4] Ivanti publishes no prices for any of these parts.
Metrics
| Ivanti term | Catalog row | What Ivanti says |
|---|---|---|
| Concurrent users (Gateway Licensing Mode) | Connect Secure concurrent user | “A license model that allows concurrent use per unique device” of ICS, with the number of concurrent devices set by the administrator on the gateway or a Virtual License Server[1] |
| Named users (NSA Named User Licensing Mode) | Unified Access License | Named user basis, “allowing connection from up to five devices with no limit on the number of gateways”; a subscription that includes software support[1] |
| Concurrent User (EULSA) | Concurrent User | Maximum simultaneous Users in the previous 30 days[8] |
Administrators use one mode or the other and can switch at any time on the license server’s Licensing Summary page; Gateway Licensing Mode is the default.[1]
Counting / floors
Gateway Licensing Mode
Core licences. In this mode separate platform/core licences must be installed, and the model runs in both on-premises and cloud deployments.[1] Catalog proof: Gateway Licensing Mode needs platform/core licences.
Allocation. A license server allocates each client a reserved user count (RUC) and a maximum user count (MUC). It also sets an incremental lease quantum (ILQ) of at least 25, unless the MUC minus the RUC is below 25, and at least 10% of that difference. The total of reserved counts cannot exceed the licences installed on the server.[4]
Leases. Reserved licences are leased for 10 days at a time and reclaimed if the client does not renew. An incremental lease is kept for at least 24 hours even if load falls.[5] When the license server is unreachable, auto-leasing lets clients raise their counts for up to 10 days. Auto-leasing applies only to non-platform-specific user capacity licences such as CONSEC-1000U-1YR. It is switched on only when average available capacity exceeds 30% of the unallocated maximum.[5] If the server cannot reconcile a client’s auto-lease usage afterwards, it disables auto-leasing for all features for five days.[5] Catalog proof: License server leases last 10 days with a 24-hour minimum.
Clusters. One cluster member leases on behalf of the others. The initial lease is the sum of the members’ reserved counts. For example, two nodes each set to reserved 50, maximum 100 and incremental 10 start at 100 licences and can grow by 20 at a time up to 200.[6]
Named users
Unified Access License. When a new user logs in to a gateway, the gateway asks NSA whether the user holds a licence. If not, NSA assigns a free one. A user who has already signed in to that gateway is allowed from the gateway’s cache.[2] Seat reservation is asynchronous. A new user who logs in when NSA has no free licences is allowed in, and the over-usage is tracked.[2] Users who have not logged in for 30 days can be deleted automatically.[2] From ICS 22.6R2 with ISAC 22.6R1 clients, login formats (Domain\username, CN, UPN) and device-then-user certificate logins are normalized to one seat.[2] Catalog proof: Unified Access License covers a named user on up to five devices; UAL logins beyond purchased seats are allowed but tracked.
Named user licences on appliances. A named user licence installed on an appliance freezes every other licence, including CONSEC and POLSEC concurrent user licences, until it is removed.[5] Each user identity may hold at most five sessions. A user logged in to two realms at once consumes one licence. Where no unique user identity can be established, as with device certificates, a single user licence is consumed.[5] The named user limit has a 10% overage.[5] Catalog proof: Installing a named user licence freezes concurrent licences; Named user licences allow five sessions per identity and a 10% overage.
Grace periods
| Situation | Grace period |
|---|---|
| ISA-V or PSA-V with subscription licences loses contact with the Pulse Cloud Licensing Service (PCLS) | 24 days[3] |
| Gateway loses contact with its License Server | 10 days[3] |
| ISA or ISA-V loses contact with Neurons Secure Access | Existing users continue; new users 5 days[3] |
| License server cluster node fails | 20 days for the surviving node[3] |
| ICS subscription licence expires on the Secure Access Platform | 31 days; ZTA subscription licences have none[3] |
Catalog proof: Connect Secure grace periods: 24, 10 or 5 days; A surviving cluster node keeps full licences for 20 days.
Virtualization & partitioning
Connect Secure runs on ISA hardware appliances and on virtual appliances (ISA-V, PSA-V).[3] In Gateway Licensing Mode each virtual appliance needs its own platform/core licence, while the Unified Access License lets any number of virtual appliances run without core licences.[2] A virtual license server does not need a platform/core licence, only a “license server” licence. In a license server cluster only one node needs that licence.[3] Active/passive license server clustering is supported on ESXi, Hyper-V and KVM, and on MS Azure, AWS, OpenStack and AliCloud for active/active clusters only.[5] The retrieved documents contain no processor- or core-based metric for Connect Secure; virtual appliance models differ in vCPUs, memory and licence capacity (ISA4000-V, ISA6000-V, ISA8000-V).[2]
Surrender and recall. A client can surrender perpetual user count licences to its license server so that other appliances of the same family can share them. Only perpetual concurrent user licences (such as CONSEC-ADD-xU) and perpetual meeting user licences (such as PSA-MTG-xU) qualify. Feature licences and duration-based licences do not, and the whole licence must be surrendered.[5] A client needs a License Member licence to surrender.[5] Ivanti’s FAQ applies this to disaster recovery. With an MBR licence, hardware appliances can lend their licences to a license server, which leases them to a DR appliance, and the appliances can pull them back.[7] Catalog proof: Only perpetual user-count licences can be surrendered.
Cloud / BYOL
Gateway Licensing Mode licences can be used in on-premises and cloud deployments.[1] Named user licences on a license server can be leased to cloud ICS and IPS deployments that have a route to the on-premises license server.[5] Under the Unified Access License the licences are managed from the Neurons for Secure Access controller, a SaaS service, so there is no customer-hosted license server.[1] The retrieved documents contain no marketplace or BYOL-specific terms.
Programs
- Licence keys. Keys are generated at the Licensing and Software Download Center (my.pulsesecure.net) from the appliance’s licensing hardware ID, a unique 16-character code, and an authorization code received after purchase.[4] Appliances can download keys automatically, checking every three months, or more often as expiry approaches.[5]
- Subscription and perpetual. Both CONSEC and POLSEC are sold as Subscription License and Perpetual License variants.[5] The Unified Access License is subscription only.[1]
- Legacy Pulse Secure support. Pulse Platinum and Pulse Gold support were withdrawn from sale on 2023-02-01. Customers move to Premium and Standard Support respectively at renewal.[9]
Contract terms
Software loaded on an Ivanti appliance may be used only on that appliance. Its licence ends if the appliance is sold or transferred, even for Perpetual Licenses.[8] Software associated with hardware does not transfer with it and must be re-purchased and registered.[10] Audit terms are those of the EULSA §14, covered in Ivanti support, renewals and audit.[8] Catalog proof: Appliance software licence ends when the appliance is sold; Software does not transfer with second-hand hardware.
Out of scope
- Ivanti Neurons for Zero Trust Access licensing, which the retrieved guide does not detail beyond the grace-period rule above.
- Hardware sizing and appliance capacity figures (ISA datasheets).
- MAG Series appliances, announced end of life from the 9.1Rx release.[5]
- Client software (Ivanti Secure Access Client) terms, which the retrieved documents do not license separately.