ASA 5540 licenses

Similar Questions

• WRVS4400N ASA 5540 L2L IPSec connection

  I have a remote WRVS4400N with a dynamic outside the address that opens a connection to an ASA 5540 with a static address.

  I'm all set on the side of the ASA.  My questions concern the 4400N.  It does not seem to have a very robust configuration/configuration available for L2L tunnels.  For one my encryption is limited to 3DES.

  But I wonder if I'm missing something in the config.  I have to configure L2L tunnels to two other firewalls.  One firewall has 3 non-contiguous networks, and the other has 2.  I have 5 tunnels configuration, this is the only way?  What I'd like to see is 2 tunnels, one for each firewall distance, but then each tunnel would have access to networks (like on the side of the ASA), is anyway to do this?  Perhaps a useful command line for this unit?

  My other question concerns the tunnel-groups I've implemented on my ASA, and I do not want to use the proper names... However I can't seem to find a way to allow this to happen on the side of 4400N... I mean, I need a way to create a 'keyword' identifier or a "firewall identifier" on the 4400N and I do not see an appropriate field in the web interface.  Someone at - it ideas?

  Thanks in advance.

  Hi WS, the WRVS router does not support a complete tunnel configuration or routes to have a multi site configuration. You would need a separate tunnel for each location.

  Traditionally, the WRVS router was not a good game on any platform ASA. In most cases, I saw when a tunnel has put in place will be the router WRVS crash in an hour or less due to low memory. If you run a scenario where the WRVS stops responding or the tunnel down, this is the likely scenario.

  I highly recommend is not to use the WRVS router for all tunnel with the ASA. If you are looking to stay in the field of small business, a RV220W or a RV042 router would be a much more suitable match.

  -Tom
  Please mark replied messages useful

• The profile number vpn that can be created in cisco asa 5540

  Hi all

  Want to know if there is a limit to how many anyconnect vpn profiles that can be created in a cisco asa 5540? TIA!

  https://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa80/configuration/g...

  Maximum connection profiles

  The maximum number of connection profiles (tunnel groups) that can support a safety device is a function of the maximum number of concurrent sessions of VPN for the + 5 platform. For example, an ASA5505 can support a maximum of 25 concurrent sessions of VPN to 30 tunnel groups (25 + 5). Attempt to add a group of additional tunnel beyond the results of limit in the following message: "ERROR: the limit of 30 groups configured tunnel has been reached.

  Table 32-2specifies the maximum VPN sessions and profiles of connection for each platform ASA.

  Table 32-2 maximum VPN Sessions and profiles of connection by ASA platform

  	5505 database / security more	5510/base/security Plus	5520	5540	5550
  Maximum VPN sessions	10/25	250	750	5000	5000
  Maximum connection profiles	15/30	255	755	5005	5005

• ASA - 5540 used for IPSec VPN only - I can do away with Nat 0?

  I'll use an ASA 5540 as our head of VPN endpoint only - and not as a firewall.

  Also, we have a class for our company internal address space routable B address, so we don't need NAT. I would like to disable the function NAT 0 if I can so I always add NAT 0 to ensure that the 5540 does not NAT.

  Y at - it an easy way to disable the need using NAT 0?

  Are there any of the draw to do that?

  You can disable the use of nat 0 disabling the nat control.

  To achieve this, go to the global configuration mode and use this command:

  no nat control

  To check whether you have it turned on, you can check it with:

  SH run nat-control

  See you soon!

  -Butterfly

• VPN site to site by using the host name on cisco asa 5540 - dyndns

  Can someone help me configure VPN site to site on cisco asa 5540. The other end is seen configured dyndns and so should set up her counterpart with the host name.

  If the other end is a dynamic IP address, you must configure a dynamic map and then use in the encryption card

  See the following example.

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00805733df.shtml

• How can I get an ASA 5540 return to the default configuration?

  Is there an easy way to re-apply the default that comes with a new ASA 5540? I would like to have the our ASA 5540 to return to its default to 192.168.1.1 inside the interface and act as a DHCP server, so I connect a PC to start the initial configuration using the ASDM.

  The ASA 5540 is running on asa723 - k8.bin.

  factory default setting

  http://www.Cisco.com/en/us/docs/security/ASA/asa72/command/reference/c4_72.html#wp2039866

  a simple "write erase/recharge" would also do the trick.

• Cisco ASA 5510 + license + AIP - SSM

  Hello.

  I have this box.

  I have a few questions about it.

  (1) I'll be able to update the firmware (from 8.2 to 8.3 or greater for example) without smarnet for ASA 5510? And what can not do without smartnet?

  (2) I have only AIP-SSM-10 module this ASA 5510. is there a smartnet, too? And when I buy only one module is it build in a subscription for 1 year for the signatures of the IPS?

  (3) if I have the Cisco ASA 5510 base license, my IPS on AIP-SSM-10 will work?

  (4) as I foresee in a purchase of the year a 5510 more with the same module and mount ther of failover. I really need license Security more than failover (active / standby)? For active/active, I know I need one, Yes?

  Please help me.

  (1) you must Smartnet in order to download the software from the download from cisco.com site.

  (2) Yes, there is also a smartnet for the AIP module. Module AIP does not come with one year subscription, but you can ask for a demo license.

  (3) Yes, the basic license is OK for the AIP module.

  (4) Yes, you would need license security more on the two ASA to be able to run any type of failover on ASA5510.

  Hope that answers your questions.

• ASA Cisco license issues

  Hello

  I'm new with Cisco licenses... I produced Cisco ASA 5505 in house with base with the limit of 10 hosts license. More information below.

  I bought the 'L-ASA5505-10-UL =' upgrade remove limit hosts and I got the certificate with Pak. But when I go to the licenses of Cisco website to get the key of activation with this PAK I you will get the error message below.

  Unfortunately I didn't take in charge of the contract so I can not open a Service request as said.

  Any help what to do?

  Error message:

  Bad Sku (s) 'L-ASA5505-10-UL =' for 'ASA5505-BUN-K9': device contains the licenses following "K9-BA-ASA5500.

  Serial number = JMX1526Zxxx

  We're sorry, but the serial number provided is not the same type of platform that serial number has failed. An upgrade is requested is not permitted.

  If you want assistance in solving this problem, please open a Service request by using the TAC Service request tool

  > View version

  The devices allowed for this platform:

  The maximum physical Interfaces: 8 perpetual

  VLAN: 3 restricted DMZ

  Double ISP: Disabled perpetual

  Junction VIRTUAL LAN ports: perpetual 0

  The hosts on the inside: 10 perpetual

  Failover: Disabled perpetual

  VPN - A: enabled perpetual

  VPN-3DES-AES: activated perpetual

  AnyConnect Premium peers: 2 perpetual

  AnyConnect Essentials: Disabled perpetual

  Counterparts in other VPNS: 10 perpetual

  Total VPN counterparts: 25 perpetual

  Shared license: disabled perpetual

  AnyConnect for Mobile: disabled perpetual

  AnyConnect Cisco VPN phone: disabled perpetual

  Assessment of Advanced endpoint: disabled perpetual

  Proxy UC phone sessions: 2 perpetual

  Proxy total UC sessions: 2 perpetual

  Botnet traffic filter: disabled perpetual

  Intercompany Media Engine: Disabled perpetual

  This platform includes a basic license.

  See you soon,.

  Henri

  It's an automatic response, or a person actually answered? License Rep must respond to your e-mail. They would be able to rehost the license for you.

• ASA 5505 license question

  Hello

  So I have two asa 5505 routers. Lets say 'router' 50 licenses a user and "router B" has 10. What it boils down to: I have two routers autour. The office where the router B and visa versa will router has.

  I wonder how licensing works, is it embedded in the device?

  If I copy the current configuration of the router A to router B, router B (the same physical box as before, just with A router config) are always 10 licenses? If I copy the current configuration of the router for A router, router B has should have still 50 licenses, right?

  Thank you!

  -John

  Hi John,.

  Licenses are always the serial number specific so even if you change the configs. 10 criticism would be has a license of 10 reviews, regardless of the configuration on it. So yes, even if change you the config, 50 user would remain user 50 and 10 critics would remain 10 reviews.

  Hope that helps

  Thank you

  Varun

• Licenses of the ASA, a license or two for a failover pair

  I had two units ASA firewall configured as a failover pair.  Now I need increases the SSL VPN license, do I need a licence for the ASA pair or two licenses, one for each unit.  Can use a key of activation on both units?

  One thing I know for sure, put the key on the Active unit, cannot synchronize the license to the standby unit.

  Thank you very much in advance.

  It depends on the version. The ASA 8.3 and later versions, you can share a single license through an HA pair.

• ASA 5540 Stateful failover routing errors

  Hello

  Having two 5540's configuration in a failover scenario. Make the LAN failover and failover state. * See attachment *.

  Failover LAN use 192.168.2.1 as active and 192.168.2.2 as before, with the subnet mask of 30. On both LAN failover use G0/2 and there is a crossover cable connecting them.

  The failover of the State uses 192.168.3.1 as active and 192.168.3.2 as before, with the subnet mask of 30. With "enable HTTP replication" checked in ASDM. On both devices State failover uses G0/3 and there is a crossover cable connecting them.

  The ASDM syslog connects errors every 10 seconds or so to say that:

  SOURCE IP ADDRESS: 192.168.3.1

  DESTINATION IP: 192.168.3.2

  Description:

  "Routing could not locate the next hop for igrp NP identity 192.168.3.1/0 in statefull:192.168.3.2/0".

  The ASA use static routes to meet the network, these roads, there are two, and both are in the 10.x.x.x network. No routing protocol is in use.

  I don't know why these errors are "spamming" my syslog and would like to get rid of them.

  Glad to hear that it works, that's the most important thing. I don't mean to preach, but Cisco does not recommend using ADJUSTABLE wires to fail on. Devices cannot always say that the captain should be and usually causes questions more than a simple link to the bottom.

• ASA 5505 Licensing / clarification of encryption

  Hello

  I have an ASA 5505 Security more than licenses.  The specific entry, that I focus on when I do a 'show' version is:

  AnyConnect Premium peer: 25 perpetual
  AnyConnect Essentials: 25 perpetual

  For my IPSEC IKEV2, I have:

  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha512
  Group 21
  FRP sha512
  seconds of life 10000

  Bringing a L2L VPN, I'm able to establish IPSEC/IKEV2 with DH group 21 without problem.
  But when I try to connect a remote client with Cisco Anyconnect, I get the following message:

  An IKEv2 remote access connection failed. Attempt to use an encryption without an AnyConnect Premium license of NSA Suite B (Group ECDH) algorithm.

  After research, I see that 19 Diffie-Hellman groups + are considered Next Gen NSA algorithms.  I guess that I don't have the correct license to support this with the AnyConnect client, so I edited my police ikev2 as follows:

  IKEv2 crypto policy 1
  14 21 group

  My problem is that I still get the same error.  Shouldn't the low AnyConnect - negotiate to group 14?  And shouldn't the L2L negotiate at the highest possible, group 21?

  All advice is appreciated.

  When you have licenses for AnyConnect Essentials and premium as ASA you must choose one or the other type for all customers AnyConnect.

  We see it in general where a customer started with the Essentials license, then later added Premium. When you do this, you must set up "no anyconnect essentials" in order to use features that require the level of Premium license.

  All Essentials customers should continue to work in your case, since the number of authorized users is equal on both types of licenses. On larger devices, licenses Premium can be less CALs Essentials since the former is sold by number of users (and can get very expensive on the larger machines because they are potentially 1000s of users) and the second is a relatively good cheap license which covers all of the device according to its material capacity.

  On the 5505 maximum capacity is 25 and you have same number already registered for the premium. (The premium SKU license available for this platform are 10 and 25).

• ASA 5510 licenses

  Hello experts!

  I'm looking forward for more information on licenses active / standby and according to this link http://www.cisco.com/en/US/partner/products/ps6120/prod_models_comparison.html I need to consider the licence security more, BUT according to this link: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_standby.html#wp1046838

  indicates that the Base license is necessary to achieve a/s HA configuration on ASA 8.2.

  The current version of the ASA: 8.0.

  I have to go to 8.2 (x) in order to activate the c/o HA configuration or is required to buy this security license more?

  Thanks in advance for your help!

  If you upgrade to 8.2 (x), you can run c/o HA without security over the license.

  If you stay with 8.0 (x), you must have Security Plus.

  With a 5505, you must always have Security Plus to c/o HA.

  Please rate if this helps.

  Thank you

  Tim

• ASA failover license

  I have two firewalls autonomous asa5525-x,

  on two of them, the command show version shows as active/active failover license. Can I use these two to make a pair of active failover / standby?

  ASA what are failover license types? Is this different from PIX?

  Active/active failover is available only for ASAs in multiple context mode. In an active/active failover configuration, the two ASAs can pass network traffic.

  Active failover / standby allows you to use an ASA helps to support the features of a failed unit. When the active unit fails, it changes sleep state while the rescue unit moves to the active state.

  For Active hybrid in multiple context mode, the ASA can switch the entire unit (including all contexts) but cannot switch on different contexts separately.

  In an active/active couple, amounts of license (if any) are merged. For example, the two 5510 s seats in a pair/active every 100 Premium SSL. The licenses will merge to have a total of 200 SSL VPN has helped the pair. The total number should be below the limit of the platform. If the number exceeds the limit of the platform (e.g. 250 SSL VPN connection on a 5510) the limit of the platform will be used on each.

  You can use the active / standby for you.

  You can check your information to license under the 'show version' and 'show activation key '. Here is an example:

  The devices allowed for this platform:<-----------------FEATURES which="" are="" available="" by="" your="">

  The maximum physical Interfaces: 8

  VLAN: 20, unrestricted DMZ

  Internal hosts: unlimited

  Failover: Active / standby

  VPN - A: enabled

  VPN-3DES-AES: enabled

  SSL VPN peers: 2

  The VPN peers total: 25

  Two Internet service providers: enabled

  VLAN Trunk Ports: 8

  Sharing license: disabled

  AnyConnect for Mobile: disabled

  AnyConnect VPN phone Cisco: enabled

  AnyConnect Essentials: disabled

  Assessment of Advanced endpoint: disabled

  Proxy sessions for the UC phone: 2

  Total number of Sessions of Proxy UC: 2

  Botnet traffic filter: disabled

  This platform includes an ASA 5505 Security Plus license.<--------------------- type="" of="" your="">

  Serial number: JMX00000000<------------------SERIAL>

  Activation key running: 0 x... 0x........ 0x........ 0x........ 0 x...<--------- activation="">

  ASA # display the keySerial activation number: JMX00000000Running activation key permanent: 0 x - 0 x - 0 x - 0 x - 0 x - x 0.
  Activation key running time: 0 x "' 0 x" ' 0 x "' 0 x" ' 0 x "' 0 x" '

  Licenses required for active/active failover

  #

  The following table shows the licenses required for this function:

  # #

  # Model	# Condition of licence
  # ASA 5505	# No support.
  # ASA 5510 ASA 5512-X	# Security Plus license.
  # All other models	# Base license.

  Conditions of licence for an active failover / standby

  #

  The following table shows the licenses required for this function:

  # #

  # Model	# Condition of licence
  # ASA 5505	# Security Plus license. (Dynamic failover is not supported).
  # ASA 5510 ASA 5512-X	# Security Plus license.
  # All other models

  #

  Base license.

  Active/active failover

  You cannot use the active/active failover and VPN; If you want to use VPN, use active failover / standby.

  http://www.Cisco.com/en/us/docs/security/ASA/asa83/license_standalone/license_management/license.html

  Please note!

  Post edited by: sachin gelin

• IPSec tunnel do not come between two ASA - 5540 s.

  I've included the appropriate configuration of the two ASA lines - 5540 s that I'm trying to set up a tunnel of 2 lan lan between. The first few lines show the messages that are generated when I try to ping another host on each side.

  Did I miss something that will prevent the tunnel to come?

  4 IP = 10.10.1.147, error: cannot delete PeerTblEntry

  3 IP = 10.10.1.147, Removing peer to peer table has not, no match!

  6 IP = 10.10.1.147, P1 retransmit msg sent to the WSF MM

  5 IP is 10.10.1.147, in double Phase 1 detected package. Retransmit the last packet.

  6 IP = 10.10.1.147, P1 retransmit msg sent to the WSF MM

  5 IP is 10.10.1.147, in double Phase 1 detected package. Retransmit the last packet.

  4 IP = 10.10.1.147, error: cannot delete PeerTblEntry

  3 IP = 10.10.1.147, Removing peer to peer table has not, no match!

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  5 IP = 10.10.1.147, IKE initiator: New Phase 1, Intf inside, IKE Peer 10.10.1.147 address Proxy local 10.10.1.135, Proxy address remote 10.10.1.155, Card Crypto (outside_map0)

  ROC-ASA5540-A # sh run

  !

  ASA Version 8.0 (3)

  !

  CRO-ASA5540-A host name

  names of

  10.10.1.135 GHC_Laptop description name to test the VPN

  10.10.1.155 SunMed_pc description name to test the VPN

  !

  interface GigabitEthernet0/0

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.10.1.129 255.255.255.240

  !

  interface GigabitEthernet0/3

  nameif outside

  security-level 0

  IP 10.10.1.145 255.255.255.248

  !

  !

  outside_2_cryptomap list extended access permit ip host host GHC_Laptop SunMed_pc

  !

  ASDM image disk0: / asdm - 603.bin

  !

  Route outside 255.255.255.248 10.10.1.152 10.10.1.147 1

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  card crypto game 2 outside_map0 address outside_2_cryptomap

  outside_map0 crypto map peer set 2 10.10.1.147

  card crypto outside_map0 2 the value transform-set ESP-3DES-SHA

  outside_map0 card crypto 2 set nat-t-disable

  outside_map0 interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  !

  Group Policy Lan-2-Lan_only internal

  attributes of Lan-2-Lan_only-group policy

  VPN-filter no

  Protocol-tunnel-VPN IPSec

  tunnel-group 10.10.1.147 type ipsec-l2l

  IPSec-attributes tunnel-group 10.10.1.147

  pre-shared-key *.

  !

  ROC-ASA5540-A #.

  ----------------------------------------------------------

  ROC-ASA5540-B # sh run

  : Saved

  :

  ASA Version 8.0 (3)

  !

  name of host ROC-ASA5540-B

  !

  names of

  name 10.10.1.135 GHC_laptop

  name 10.10.1.155 SunMed_PC

  !

  interface GigabitEthernet0/0

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.10.1.153 255.255.255.248

  !

  interface GigabitEthernet0/3

  nameif outside

  security-level 0

  IP 10.10.1.147 255.255.255.248

  !

  outside_cryptomap list extended access permit ip host host SunMed_PC GHC_laptop

  !

  ASDM image disk0: / asdm - 603.bin

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  card crypto outside_map2 1 match address outside_cryptomap

  outside_map2 card crypto 1jeu peer 10.10.1.145

  outside_map2 card crypto 1jeu transform-set ESP-3DES-SHA

  outside_map2 card crypto 1jeu nat-t-disable

  outside_map2 interface card crypto outside

  crypto ISAKMP allow inside

  crypto ISAKMP policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  !

  internal Lan-2-Lan group strategy

  Lan Lan 2-strategy of group attributes

  Protocol-tunnel-VPN IPSec

  tunnel-group 10.10.1.145 type ipsec-l2l

  IPSec-attributes tunnel-group 10.10.1.145

  pre-shared-key *.

  !

  ROC-ASA5540-B #.

  On the ASA of ROC-ASA5540-B, you have "isakmp allows inside", it should be "enable isakmp outside."

  Please reconfigure the ASA and let me know how it goes.

  Kind regards

  Arul

  * Please note the useful messages *.