ASA failover license

Similar Questions

• ASA 5500 SSL VPN Failover license

  Hello

  I have a partner who request assistance with SSL VPN licenses on the ASA 5500 firewall sharing:

  His question is:

  Both SSL, provided with the firewall of the SAA, licenses can be shared across a couple active / standby?  I would therefore have a total of (4) licenses of SSL VPN to use?

  This would also be true for two security contexts that are included with the firewall?

  For example, I buy two base ASA 5520 firewall, running active / standby, that each machine is supplied with SSL VPN licenses (2) and (2) licensing of security contexts? In version 8.3, the licenses are cumulative by failover pairs, so I should a total SSL VPN (4) and (4) security contexts?

  Here is my response to his request:

  Based on this link (http://www.cisco.com/en/US/partner/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1449664)

  It was mentioned that:

  "You can have one active license type, either the AnyConnect Essentials license or the AnyConnect Premium license. By default, the Adaptive security apparatus includes an AnyConnect Premium license for 2 sessions. If you install the AnyConnect Essentials license, it is used by default. See not anyconnect-essentials control or in ASDM Configuration > remote access VPN > network (Client) access > advanced > component AnyConnect Essentials to activate the Premium license instead. »

  It will be able to share the included license on the ASA 5500 4. It will be able to share these licenses, but I'm not sure the security context. My answer would be, it can use only 2 context Security licenses since only the VPN licenses are shared on the version 8.3 and other licenses not characteristic. My understanding is correct? or there are other explanations on my customer survey?

  Thanks in advance!

  Ice Flancia

  Cisco partner Helpline Tier 2 team

  Only from ASA 8.3 version and following, the license can be combined on a failover pair active / standby.

  2 SSL included license on SAA in failover pair is combined as 4 license SSL.

  2 license of background on ASA in failover pair is combined as license frame 4.

  Here's the URL on ASA combined license failover:

  http://www.Cisco.com/en/us/partner/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1450094

  Hope that helps.

• Cisco ASA failover KeepAlive - classification and prioritization

  Hello

  I have a busy layer two link between data centers and must ensure that traffic keepalive failover between ASA firewalls at each data center goes through.

  I want to implement layer 2 quality of service on the route. Can you classify and prioritize ASA failover keep alive the traffic? If so what ports should I use or it is already ranked by the ASA?

  Thank you

  Hello

  If you want to apply the QoS on switching between ASA link, you need to do:

  -Mark traffic on switches facing interface failover ASA

  -All intermediate switches must approve the value of QoS and applye your QoS policy (reservation of bandwidth based on qos value chosen before).

  Assume that your main unit failover ip is 192.168.100.1 and 192.168.100.2 for the secondary unit.

  The acl to classify the traffic is:

  Of with the ASA2 ASA1

  HA - ASA extended IP access list

  permit ip host 192.168.100.1 192.168.100.2

  Of ASA2 to ASA1:

  HA - ASA extended IP access list

  ip licensing 192.168.100.2 host 192.168.100.1

  Hope that answers your question.

  Thank you.

  PS: If this solved your problem, please do not forget to note and mark it as correct.

• ASA 5540 licenses

  Am I limited to a certain number of sessions anyconnect? Should clarify it please?

  The devices allowed for this platform:

  The maximum physical Interfaces: unlimited

  VLAN maximum: 200

  Internal hosts: unlimited

  Failover: Active/active

  VPN - A: enabled

  VPN-3DES-AES: enabled

  Security contexts: 2

  GTP/GPRS: disabled

  VPN peers: 5000

  WebVPN peers: 2

  AnyConnect for Mobile: disabled

  AnyConnect for Linksys phone: disabled

  Assessment of Advanced endpoint: disabled

  Proxy UC sessions: 2

  It seems that you have the basic licence that only support 2 session anyconnect.

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/license/license82.html#wp172967

• Licenses of the ASA, a license or two for a failover pair

  I had two units ASA firewall configured as a failover pair.  Now I need increases the SSL VPN license, do I need a licence for the ASA pair or two licenses, one for each unit.  Can use a key of activation on both units?

  One thing I know for sure, put the key on the Active unit, cannot synchronize the license to the standby unit.

  Thank you very much in advance.

  It depends on the version. The ASA 8.3 and later versions, you can share a single license through an HA pair.

• Cisco ASA 5510 + license + AIP - SSM

  Hello.

  I have this box.

  I have a few questions about it.

  (1) I'll be able to update the firmware (from 8.2 to 8.3 or greater for example) without smarnet for ASA 5510? And what can not do without smartnet?

  (2) I have only AIP-SSM-10 module this ASA 5510. is there a smartnet, too? And when I buy only one module is it build in a subscription for 1 year for the signatures of the IPS?

  (3) if I have the Cisco ASA 5510 base license, my IPS on AIP-SSM-10 will work?

  (4) as I foresee in a purchase of the year a 5510 more with the same module and mount ther of failover. I really need license Security more than failover (active / standby)? For active/active, I know I need one, Yes?

  Please help me.

  (1) you must Smartnet in order to download the software from the download from cisco.com site.

  (2) Yes, there is also a smartnet for the AIP module. Module AIP does not come with one year subscription, but you can ask for a demo license.

  (3) Yes, the basic license is OK for the AIP module.

  (4) Yes, you would need license security more on the two ASA to be able to run any type of failover on ASA5510.

  Hope that answers your questions.

• ASA Cisco license issues

  Hello

  I'm new with Cisco licenses... I produced Cisco ASA 5505 in house with base with the limit of 10 hosts license. More information below.

  I bought the 'L-ASA5505-10-UL =' upgrade remove limit hosts and I got the certificate with Pak. But when I go to the licenses of Cisco website to get the key of activation with this PAK I you will get the error message below.

  Unfortunately I didn't take in charge of the contract so I can not open a Service request as said.

  Any help what to do?

  Error message:

  Bad Sku (s) 'L-ASA5505-10-UL =' for 'ASA5505-BUN-K9': device contains the licenses following "K9-BA-ASA5500.

  Serial number = JMX1526Zxxx

  We're sorry, but the serial number provided is not the same type of platform that serial number has failed. An upgrade is requested is not permitted.

  If you want assistance in solving this problem, please open a Service request by using the TAC Service request tool

  > View version

  The devices allowed for this platform:

  The maximum physical Interfaces: 8 perpetual

  VLAN: 3 restricted DMZ

  Double ISP: Disabled perpetual

  Junction VIRTUAL LAN ports: perpetual 0

  The hosts on the inside: 10 perpetual

  Failover: Disabled perpetual

  VPN - A: enabled perpetual

  VPN-3DES-AES: activated perpetual

  AnyConnect Premium peers: 2 perpetual

  AnyConnect Essentials: Disabled perpetual

  Counterparts in other VPNS: 10 perpetual

  Total VPN counterparts: 25 perpetual

  Shared license: disabled perpetual

  AnyConnect for Mobile: disabled perpetual

  AnyConnect Cisco VPN phone: disabled perpetual

  Assessment of Advanced endpoint: disabled perpetual

  Proxy UC phone sessions: 2 perpetual

  Proxy total UC sessions: 2 perpetual

  Botnet traffic filter: disabled perpetual

  Intercompany Media Engine: Disabled perpetual

  This platform includes a basic license.

  See you soon,.

  Henri

  It's an automatic response, or a person actually answered? License Rep must respond to your e-mail. They would be able to rehost the license for you.

• How SSL VPN packages for two ASAs clustered licenses

  Hi all!

  If I have installed two Cisco ASA 5550 (ASA5550-BUN-K9) in failover mode, which I know support only 2 concurrent sessions of SSL VPN and you want to upgrade my boxes to support 15 AnyConnect SSL VPN sessions, how many licenses packages I need to buy?

  An ASA5500-SSL-25 for both boxes or two ASA5500-SSL-25 for one per box?

  Depends on what version of ASA you are running.

  If you are running version 8.3 and above, then you just buy 1 ASA5500-SSL-25 for a failover pair and it would work. If you buy 2 ASA5500-SSL-25, one license per box in failover pair, then the license gets grouped into 50 SSL user license.

  Here is the license information for ASA version 8.3 for failover pair:

  http://www.Cisco.com/en/us/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1315746

  For ASA running version 8.2 and below, you are required to buy 2 ASA5500-SSL-25 (one of each ASA in the failover pair) as the license should be exactly the same for the pair to failover to work, in the earlier version of the SAA.

  Hope that makes sense.

• Selection of ASA 5505 license and Smartnet

  Hello

  We bought an ASA 5505 (ASA5505-BUN-K9) and more recently bought the license to upgrade from 10 to 50 users (L-ASA5505-10-50).

  I want to provide remote access to users via AnyConnect - specifically, AnyConnnect under Windows as well as iPhone/iPad and Android.  My understanding is that I should buy the Anyconnect Essentials (L-ASA-AC-E-5505) and permits Anyconnect Mobile (L-ASA-AC-M-5505).  Is this correct?  If I do this, simultaneous remote access VPN connections (via the Anyconnect customers) how the ASA will then support?

  In addition, we did not purchase initially Smartnet with this device, but I want to do to access the software updates.  Y at - it a document or a site where I can locate the SKU # s Smartnet contracts that would be appropriate with our device?  Or could someone provide a few example SKU #?

  The output of 'see the version' is below:

  Cisco Adaptive Security Appliance Software Version 8.3 (1)

  Version 6.3 Device Manager (1)

  Updated Friday, March 4, 10 16:56 by manufacturers

  System image file is "disk0: / asa831 - k8.bin.

  The configuration file to the startup was "startup-config '.

  asa1 until dry 42

  Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor

  Internal ATA Compact Flash, 128 MB

  BIOS Flash M50FW016 @ 0xfff00000, 2048KB

  Hardware encryption device: Cisco ASA-5505 Accelerator Board (revision 0 x 0)

  Start firmware: CN1000-MC-BOOT - 2.00

  SSL/IKE firmware: CNLite-MC-Smls-PLUS - 2.03

  Microcode IPSec:-CNlite-MC-IPSECm-HAND - 2.06

  0: Int: internal-Data0/0: the address is 649e.f3b3.c2bb, irq 11

  1: Ext: Ethernet0/0: the address is 649e.f3b3.c2b3, irq 255

  2: Ext: Ethernet0/1: the address is 649e.f3b3.c2b4, irq 255

  3: Ext: Ethernet0/2: the address is 649e.f3b3.c2b5, irq 255

  4: Ext: Ethernet0/3: the address is 649e.f3b3.c2b6, irq 255

  5: Ext: Ethernet0/4: the address is 649e.f3b3.c2b7, irq 255

  6: Ext: Ethernet0/5: the address is 649e.f3b3.c2b8, irq 255

  7: Ext: Ethernet0/6: the address is 649e.f3b3.c2b9, irq 255

  8: Ext: Ethernet0/7: the address is 649e.f3b3.c2ba, irq 255

  9: Int: internal-Data0/1: the address is 0000.0003.0002, irq 255

  10: Int: not used: irq 255

  11: Int: not used: irq 255

  The devices allowed for this platform:

  The maximum physical Interfaces: 8 perpetual

  VLAN: 3 restricted DMZ

  Double ISP: Disabled perpetual

  Junction VIRTUAL LAN ports: perpetual 0

  The hosts on the inside: 50 perpetual

  Failover: Disabled perpetual

  VPN - A: enabled perpetual

  VPN-3DES-AES: activated perpetual

  SSL VPN peers: 2 perpetual

  Counterparts in total VPN: 10 perpetual

  Shared license: disabled perpetual

  AnyConnect for Mobile: disabled perpetual

  AnyConnect Cisco VPN phone: disabled perpetual

  AnyConnect Essentials: Disabled perpetual

  Assessment of Advanced endpoint: disabled perpetual

  Proxy UC phone sessions: 2 perpetual

  Proxy total UC sessions: 2 perpetual

  Botnet traffic filter: disabled perpetual

  Intercompany Media Engine: Disabled perpetual

  This platform includes a basic license.

  ---

  Thank you!

  Yes you are right, you must purchase the license key AnyConnect and AnyConnect Mobile, and you can run 25 maximum simultaneous AnyConnect

  Here are the compatible Android devices for your reference:

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect25/release/notes/RN-AC2.5-Android.html#wp1159723

  For Smartnet, whereby the service level you need, here are a few examples for ASA5505:

  -SMARTnet Premium 24 x 7 x 4 (SNTP): SNTP-CON-AS5B50K9

  -SMARTnet 8x5xNBD (SWW): CON-SNT-AS5B50K9

• ASA 5505 license question

  Hello

  So I have two asa 5505 routers. Lets say 'router' 50 licenses a user and "router B" has 10. What it boils down to: I have two routers autour. The office where the router B and visa versa will router has.

  I wonder how licensing works, is it embedded in the device?

  If I copy the current configuration of the router A to router B, router B (the same physical box as before, just with A router config) are always 10 licenses? If I copy the current configuration of the router for A router, router B has should have still 50 licenses, right?

  Thank you!

  -John

  Hi John,.

  Licenses are always the serial number specific so even if you change the configs. 10 criticism would be has a license of 10 reviews, regardless of the configuration on it. So yes, even if change you the config, 50 user would remain user 50 and 10 critics would remain 10 reviews.

  Hope that helps

  Thank you

  Varun

• history of ASA failover

  Hello

  Anyone have a link to the document from cisco or an article that describes the States of failover and the sense of history?

  Thank you very much

  Hi cisco8887 ,

  Command "Show tilting history" could be useful in this situation.

  Read more about it below:

  http://www.Cisco.com/c/en/us/TD/docs/security/ASA/ASA-command-reference/S/cmdref3/S7.html

  It may be useful

  -Randy-

• ASA 5505 Licensing / clarification of encryption

  Hello

  I have an ASA 5505 Security more than licenses.  The specific entry, that I focus on when I do a 'show' version is:

  AnyConnect Premium peer: 25 perpetual
  AnyConnect Essentials: 25 perpetual

  For my IPSEC IKEV2, I have:

  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha512
  Group 21
  FRP sha512
  seconds of life 10000

  Bringing a L2L VPN, I'm able to establish IPSEC/IKEV2 with DH group 21 without problem.
  But when I try to connect a remote client with Cisco Anyconnect, I get the following message:

  An IKEv2 remote access connection failed. Attempt to use an encryption without an AnyConnect Premium license of NSA Suite B (Group ECDH) algorithm.

  After research, I see that 19 Diffie-Hellman groups + are considered Next Gen NSA algorithms.  I guess that I don't have the correct license to support this with the AnyConnect client, so I edited my police ikev2 as follows:

  IKEv2 crypto policy 1
  14 21 group

  My problem is that I still get the same error.  Shouldn't the low AnyConnect - negotiate to group 14?  And shouldn't the L2L negotiate at the highest possible, group 21?

  All advice is appreciated.

  When you have licenses for AnyConnect Essentials and premium as ASA you must choose one or the other type for all customers AnyConnect.

  We see it in general where a customer started with the Essentials license, then later added Premium. When you do this, you must set up "no anyconnect essentials" in order to use features that require the level of Premium license.

  All Essentials customers should continue to work in your case, since the number of authorized users is equal on both types of licenses. On larger devices, licenses Premium can be less CALs Essentials since the former is sold by number of users (and can get very expensive on the larger machines because they are potentially 1000s of users) and the second is a relatively good cheap license which covers all of the device according to its material capacity.

  On the 5505 maximum capacity is 25 and you have same number already registered for the premium. (The premium SKU license available for this platform are 10 and 25).

• ASA 5510 licenses

  Hello experts!

  I'm looking forward for more information on licenses active / standby and according to this link http://www.cisco.com/en/US/partner/products/ps6120/prod_models_comparison.html I need to consider the licence security more, BUT according to this link: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_standby.html#wp1046838

  indicates that the Base license is necessary to achieve a/s HA configuration on ASA 8.2.

  The current version of the ASA: 8.0.

  I have to go to 8.2 (x) in order to activate the c/o HA configuration or is required to buy this security license more?

  Thanks in advance for your help!

  If you upgrade to 8.2 (x), you can run c/o HA without security over the license.

  If you stay with 8.0 (x), you must have Security Plus.

  With a 5505, you must always have Security Plus to c/o HA.

  Please rate if this helps.

  Thank you

  Tim

• ASA 5506 - license error

  I get my new home of ASA5506-X and pop of their opening, ready to set up fully, then I get the following error:

  «With the current system of license will be only supports 2 interfaces fully function.» Third interface can be added but the traffic from this interface to another interface need to be blocked. »

  Why have I not 8 ports on the firewall and I can't use them?  Only, I get this message in the ASDM.  No where in the documentation for cisco reported that there is a license limit.  When I look at the NVA of show, I see "Interface physics Maximum: unlimited."

  I hope that this is a bug any.

  Thank you.

  It looks like a bug. What ASDM version do you use?

  It is certainly not a restriction of unity - even with the Base license. Reference.

• Help license SSL Info failover ASA 8.2 8.3

  Hello

  I have a question about lincense.

  I have a 8.2 in HA cluster, active failover.

  I bought 100 VPN SSL lic 4 months ago for ASA active and ensures 100 lic for ASA in mode.

  So on each firewall there is a lic for 100 SSL VPN.

  If I switch to 8.3 the ICA became 200 or even 100 assets and 100 for emergency unit?

  because I've read in this doc

  http://www.Cisco.com/en/us/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1428452

  Here "How failover Licenses combine" that there is the possibility that the linces can became a lincense cluster.

  Can you help me? Is there someone who try this feature?

  Thank you very much.

  Yes, you are absolutely right. With version 8.3, the license will be mixed, and you'll have 200 user license to use. But please please be advised that for example if you have 500 user license on each, with a combined of 1000 user license, and the ASA platform only supports the 750 user license, you are limited to the user license only 750.

  PS: If you want to upgrade to version 8.3, please check changes of NAT and ACLs. NAT changed completely with the concept of double NAT and NAT object network.

  Hope that answers your question.