Cisco ASA firewall licensing used to be pretty simple, but as features were rolled out as licenses, the scheme became quite complex. The matters are further complicated since different appliances and versions change the rules. This document will help you make sense of ASA licensing, but is not intended to be used as a design guide. Make sure you work with your reseller if you are looking to deploy these features.
The 5520 and up do not have Security Plus licensing. They come with the Base license and need nothing more to get the most performance out of the unit. Update: As Stojan pointed out in the comments, the 5585X series does have Security Plus licenses which enables the 10GB SFP+ slots.
Asa 5505 License Keygen 13
In an active/active pair, license quantities (when applicable) are merged. For example, two 5510s are in an active/active pair with 100 SSL Premium seats each. The licenses will merge to have a total of 200 SSL VPNs allowed in the pair. The combined number must be below the platform limitation. If the count exceeds the platform limit (ex. 250 SSL VPN connections on a 5510) the platform limit will be used on each.
ASA Flex licenses are temporary SSL VPN licenses for emergencies or situations where there is a temporary peak in SSL VPN connections. Each license is valid for 60 days. Perhaps these are best explained as a scenario.
If XYZ Corp. has their building up and running again earlier than 60 days, the administrator can disable the temporary license by reactivating the permanent license they were previously using. This will pause the timer on the Flex licenses, allowing them to use the remainder of the time in the future.
Large deployments of SSL VPN may require multiple ASAs positioned in multiple geographic areas. Shared licenses allow a single purchase of SSL VPN licenses to be used on multiple ASAs, possibly over large physical areas. Starting with software v8.2, Cisco allows the shared license to ease this situation. Shared licenses are broken into two types: main and participant. The main license starts at 500 SSL Premium sessions and scales to 100,000 sessions. The main license acts as a license pool which participants pull from in 50 session increments. A secondary ASA can act as a backup in case the primary fails. There is no specific backup license, as the ASA only requires a participant license. If there is no secondary ASA, the participant ASAs may not be able to reach the main ASA in the event of a connectivity problem. The participant ASA is able to use the sessions that were last borrowed from the main for 24 hours. Beyond 24 hours, the sessions are released. Currently connected clients are not disconnected but new connections are not allowed.
Advanced Endpoint Assessment will scan a SSL VPN client using Cisco Secure Desktop for security policy compliance and attempt to remediate if the system is out of compliance. This is similar but a little less feature-rich than NAC. Licenses are simple for Advanced Endpoint Assessment. One license per ASA is required in addition to SSL Premium. If the ASA is in a HA pair, one license per pair is required if using ASA software v. 8.3(1) or later.
Hi I plan to buy a ASA5510-BUN-K9 (Firewall edition) as I understand it comes with 2 SSL VPN (premium) License. I need to 50 SSL VPN connections, is this the correct part number ASA5500-SSL-50 (spare license) ? or should I get an upgrade license? what is the difference between spare and upgrade premium vpn license ?
Your ASA needs to be on premium license atleast to understand client-less (web) based SSL VPN support (sessions based on the no. of SSL user license you have). Advanced Endpoint Assessment would need to be purchased at an additional cost (approx $1K per ASA) and would work if you are on premium. AnyConnect essential is only useful if you want to use IPSec or SSL VPN via AnyConnect VPN client, and utlize the max VPN peer session limit (5K in ASA5550). Hope this helps.
2ff7e9595c
Comments