/ 01
ACS is dead and ISE is a mortgage
Cisco ACS left support in 2020 and the official migration path was ISE. Teams that only ever needed TACACS+ for device admin ended up licensing — and operating — a full NAC platform to keep it.
When ACS reached end-of-support, TACACS+ shops were marched toward ISE — a full NAC platform, licensed per endpoint, with device administration sold as an add-on. If what you actually need is device admin AAA — TACACS+ and RADIUS with a real UI, command accounting, and an audit trail — Innovexus does that for free, as a self-hosted appliance. And to be plain about the boundary up front: Innovexus is not a NAC. If you need 802.1X, posture, or profiling, ISE still earns its licence. This page maps where each one wins.
ISE pricing is quote-based and layered: endpoint-tier subscriptions, a separately licensed device-administration feature, and hardware sized for a NAC workload. The figures below are industry estimates for mid-market deployments.
Cisco pricing varies by enterprise agreement and is quoted, not listed; treat the ISE figures as industry estimates. Innovexus is free regardless of fleet size — your only cost is the VM it runs on.
ISE and Innovexus overlap on exactly one role: AAA for network device administration. Around that overlap they are different products — ISE is a network access control platform, Innovexus is device-admin AAA fused with PAM and operations tooling. The honest matrix:
The pattern in almost every case: the team needed device administration AAA, and ISE was the only sanctioned way to keep TACACS+ after ACS died.
Cisco ACS left support in 2020 and the official migration path was ISE. Teams that only ever needed TACACS+ for device admin ended up licensing — and operating — a full NAC platform to keep it.
In ISE, TACACS+ device administration is a separately licensed feature on top of endpoint tiers. In Innovexus it is the product: TACACS+, RADIUS, command accounting, and the audit trail, with nothing extra to license.
Import the OVA, answer two questions on first boot, point a lab switch at it. About fifteen minutes to a working AAA server, against an ISE deployment measured in weeks of design and node build-out.
TACACS+ accounting captures every command; session recording captures the full session around it; the audit chain is hash-chained and exportable for your compliance reviews — straight from the box.
There is no quote to request and no trial clock. Run it next to your existing AAA, compare the audit trails, and decide with evidence instead of a sales cycle.
This section exists because the fastest way to lose a network engineer’s trust is to pretend a device-admin appliance is a NAC platform. It is not.
We'd rather you pick the right tool than the wrong one for the wrong reasons. If any of the above describes you, we genuinely think Cisco ISE is the better pick.
Direct, sourced answers to the questions teams ask when evaluating Innovexus as a Cisco ISE alternative.
For device administration AAA — TACACS+ and RADIUS logins to routers, switches, firewalls, with command authorization and accounting — yes; that is the core of the product, and it adds a credential vault and session recording that ISE never had. For 802.1X, NAC, posture, or profiling: no. Innovexus does not ship network access control today. Plenty of shops run Innovexus for device admin beside a NAC that keeps doing port authentication.
Not today. Port-based NAC and 802.1X are on the roadmap, and we would rather say that plainly than sell you a NAC that does not exist. If 802.1X is a hard requirement now, keep ISE or ClearPass for that role.
Free — no licence, no seats, no tiers, no trial clock. The whole boundary is written out at innovexus.io/pricing: you run it on your own infrastructure, there is no attestation like SOC 2 to inherit from us, and support is the community forum plus [email protected] rather than a paid contract. A free account gates the download and holds the activation code that enrolls your appliance for CVE/KEV and threat-intelligence feeds.
The same way AAA migrations have always worked: stand Innovexus up in parallel, add it to the AAA server list on a handful of lab devices, verify authentication, authorization, and accounting against real traffic, then stage the rest of the fleet device-by-device and retire the old server last. No forklift moment — both servers answer during the transition.
One VM. Import the OVA into VMware, VirtualBox, or Proxmox, or boot the ISO on bare metal. Sizing guidance by fleet size is on the downloads page; first boot asks two questions and you are at a login prompt in about fifteen minutes.
Yes — TACACS+ command authorization and accounting at the device level, with the appliance recording the full brokered session on top, so the audit trail shows both what was typed and what happened around it.
Stand the appliance up beside your existing AAA, add it to the server list on a lab device, and compare the audit trails. Free account, no card, no quote, no clock.