Content Security Licensing on Cisco ASA

Hi Guys,
Need help on licensing of content security on Cisco ASAs. Hope someone would be able to help.
Our customer has a ASA5520-CSC20-K9 (default 500 users) appliance. When the appliance was first bought, they upgraded it to 750 user license and PLUS feature license. They want to renew these licenses. Kindly advise the following:
1. In order to do so, is it right that the customer has to purchase both the following (to cater to the 750 users and PLUS features)?
• L-ASACSC20-500UP1Y     ASA 5500 CSC-SSM-20 500-User w/ Plus Lic. Renewal (1-year)
• L-ASACSC20-250UP1Y     ASA 5500 CSC-SSM-20 250-User w/ Plus Lic. Renewal (1-year)
2. Do the renewal licenses above include BASE features (Anti-Virus, Anti-Spyware, File-Blocking)?
Thanks!
Citra

That unfortunate.  It seems like with the VPN licensing they realized if you were in an active/standby configuration then you should only have to pay for one license, thus the license change in 8.3+ only requires you to purchase one license.  I thought this would have carried over into IPS. 
Beings we haven't failed over to the standby unit in 2 years, would it be possible to install the IPS module in both the active and standby appliances, but just license the one in the active mode?  I don't care if we are running without IPS on the standby if we did have to failover for some amount of time.  Or does having it licensed on one and not the other mess with being in active/standby failover mode?

Similar Messages

  • Security License for Cisco 3900 Series

    Hi,
    I am having    Security License  (SL-39-SEC-K9)  for Cisco 3900 Series router, Can somebody help me to provide sample config to configure 3945 router to act as firewall. Is there any difference with the native IOS based firewall config..
    Regards,
    Mukesh           

    Here is a detailed instruction on ISR G2 licensing (including downloading, installing, rehosting license, etc.).
    Usually, you just need to go to cisco.com/go/license, enter PAK and follow detailed instructions.
    HTH
    Alexandr

  • Security License for Cisco 3925

    Hi,
    I have got cisco 3925 without security license. Now I have got the L-SL-39-SEC-K9 license and need to install it. What is the process of installing this license.
    Thanks in advance
    Regards,
    Mero

    Here is a detailed instruction on ISR G2 licensing (including downloading, installing, rehosting license, etc.).
    Usually, you just need to go to cisco.com/go/license, enter PAK and follow detailed instructions.
    HTH
    Alexandr

  • Cisco ASA 5510 Content Security bundle

    Hello,
    please help me  to understand if i buy  the    Cisco ASA 5510 Content Security bundle  for  my  network   found  there is   1 yr subscription for the content
    security features.  what are  services included in it.  Does   URL blocking and filtering  includ  in this subscription  or  its a seperate features.
    Thanks,
    Saroj Pradhan

    Here is the license for CSC module and it lists what is included in Basic and Plus CSC license:
    http://www.cisco.com/en/US/docs/security/csc/csc66/administration/guide/csc1.html#wp1045405
    One year subscription is providing you the ability to upgrade the virus scan engine, spyware pattern file, anti spam, etc

  • Firewall Cisco ASA 5505 new interface license problem

    Hi
    I have one ASA 5505 with a Base License
    The problem is when i want to use a new named interface the system says "With current License maximum number of named interfaces allowed is 3. Name cannot be set for this interface"
    And the question is if with this base license the interface cannot be used or only cannot be named?
    here the output of my firewall:
    Cisco Adaptive Security Appliance Software Version 8.2(5)
    Device Manager Version 6.4(5)
    Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
    0: Int: Internal-Data0/0    : address is e02f.6de6.7843, irq 11
    1: Ext: Ethernet0/0         : address is e02f.6de6.783b, irq 255
    2: Ext: Ethernet0/1         : address is e02f.6de6.783c, irq 255
    3: Ext: Ethernet0/2         : address is e02f.6de6.783d, irq 255
    4: Ext: Ethernet0/3         : address is e02f.6de6.783e, irq 255
    5: Ext: Ethernet0/4         : address is e02f.6de6.783f, irq 255
    6: Ext: Ethernet0/5         : address is e02f.6de6.7840, irq 255
    7: Ext: Ethernet0/6         : address is e02f.6de6.7841, irq 255
    8: Ext: Ethernet0/7         : address is e02f.6de6.7842, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces    : 8        
    VLANs                          : 3, DMZ Restricted
    Inside Hosts                   : Unlimited
    Failover                       : Disabled
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 10       
    Dual ISPs                      : Disabled 
    VLAN Trunk Ports               : 0        
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          : Disabled 
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled 

    Hi,
    The ASA5505 has with Base License the limitation of 3 Vlan interface of which 1 is also limited in access (shown by the above output mentioning DMZ Restricted)
    For an interface on the ASA to operate it must have a name with the command "nameif"
    If you already have 3 Vlan interfaces in use then with this license you wont be able to configure 4th Vlan interface without getting a license that supports more interfaces. I guess that would be the Security Plus license.
    I know that this has come as a surprise to several users that have posted here on the forums. I too think that its a needles "feature" in the ASA to limit the use of the device in such a way.
    - Jouni

  • Cisco ASA 5505 - 2 questions - VPN Licensing; Routing

    Hi,
    I have a client that has a Cisco ASA 5505 security appliance.  Currently it is setup as a "proof of concept" for clientless browser-based SSL VPN.  The device came with 2 licenses for this service, and we need to increase that somewhere between 10-25 users.  25 users is the max on this device I believe.
    I have searched Cisco.com and tried Googling the ASA 5505 for licensing but I can't find the correct license that I need for this.
    The second question I have is routing capability.  We have a WAN connection to another branch of the computer from this location where the ASA 5505 is located.  A Cisco 2851 is used for this connection.  We are wanting to bring in a high speed Internet connection for the VPN access and Internet access.  What I need to know is can we put the WAN and Internet connections behind the ASA 5505 and have that route appropriately to the branch WAN for that traffic and all other traffic to the Internet?
    Thanks!
    --Kent

    Hi Kent,
    Thank you for your question.  This community is for Cisco Small Business products and your question is in reference to a Cisco Elite/Classic product.  Please post your question in the Cisco NetPro forums located here: http://forums.cisco.com/eforum/servlet/NetProf?page=main (http://forums.cisco.com/eforum/servlet/NetProf?page=main) This forum has subject matter experts on Cisco Elite/Classic products that may be able to answer your question.
    Regards,
    David Dunlap
    SBSC Engineer

  • Numbers of users for ASA Content Security module

    Hi,
    Can someone tell me how the ASA Content Security module recognize the maxi number of users ?
    eg. :  ASA-SSM-CSC-20-K9= is for 500 users. What will happen if I exceed to 560 users ?  Does the module recognize that there are more users than expected ?
    Best regards

    You will get similar message
    License violation has been detected on the InterScan for CSC SSM. There are currently 560 active nodes while you only have 500 seats of license. 60 more seats of license is required.
    Please upgrade your license to resolve the violation.

  • VLAN problems with SG200-8P and Cisco ASA 5505 (Sec Plus license)

    Hi,  I've been pulling my hair out trying to get simple vlan trunking working between these devices.
    Basically, no clients on VLAN 99 (guest) will receive DHCP ip addresses when plugged into the SG200.  I have the SG200<>ASA VLAN trunk configured correctly, as I know it, and I've tried numerous variations (set trunk as general tag/untagged, etc., set the ap port to general tag/untag, etc).   Both AP's work properly when connected to the ASA e0/3 port but either will only pull the "inside" VLAN dhcp address when connected to the SG200 switch
    VLAN 1 - inside (has separate dhcp scope assigned by ASA)
    VLAN 99 - guest (has separate dhcp scope assigned by ASA)
    SG200
    purpose
    ASA 5505 (Sec Plus license)
    purpose
    g2
    Trunk 1UP,99T
    Ubiquiti AP (VLAN 1 works, VLAN 99 does not
    g3
    Access port 99T
    vlan 99 does not work
    g8
    Trunk 1UP, 99T
    < Trunk between switch and ASA >
    Int e0/2
    switchport trunk allowed vlan 1,99
     switchport trunk native vlan 1
     switchport mode trunk
    Int e0/3
    switchport trunk allowed vlan 1,99
     switchport trunk native vlan 1
     switchport mode trunk
    Second ubiquiti AP
    Both VLAN 1 and VLAN 99 clients work properly

    Frustrated - yes.  Confused - maybe not as much, but I could have put some more effort into the overall picture.
    There are two VLANs (1 - native) and (99 - guest).   There is a trunk port between the SG200 and the ASA configured as 1-untagged 99 - tagged.    
    No clients connected to the SG200 on VLAN 99  are able to access the ASA VLAN 99 using either a static VLAN IP address or DHCP.   The problem occurs whether I configure the SG200 with an access port 99-tagged or Trunk port 1UP, 99T or general port 1U, 99UP or any combination thereof.
    Anything connected to the SG200 on the native VLAN works properly.
    Anything connected to the ASA VLANs (1 or 99) works properly
    I have not yet tried to see what the switch is doing with the VLAN tags but I suspect I have some mismatch with the Linksys/Cisco SG200 way of setting up a VLAN and how traditional Cisco switches work.
    I was hoping someone with a working SG200 - Cisco ASA setup could share their port/trunk/VLAN settings or perhaps point me in the right direction.
    SG200 g2 - trunk port (1UP, 99T) -- Access Point
    SG200 g2 - access port (99U)
    SG200 g8 - trunk port (1UP, 99T)  connected to ASA5505  e0/3  
    ASA5505 e0/3  (switchport trunk allowed vlan 1,99,  switchport trunk native vlan 1,  switchport mode trunk)
    Thanks,

  • CIsco ASA 5505 and VPN licenses

    Hi,
    Cisco ASA 5505 comes with 10 VPN licenses in a standard configuration.
    How those licenses are counted? Will I need a license per one IPSec SA?
    If I have two site connected with LAN-to-LAN VPN with 10 subnets at one site, how many licenses will be taken? 10 - one per IPSec SA or just 1 - one per point-to-point VPN?
    Thank you.
    Regards,
    Alex

    Alex,
    In an ASA 5505, it should say something like this...when you do sh ver.
    VPN Peers : 25
    It means that you can have so many peers connecting to the ASA. Its not per IPSec SA.
    Its a per tunnel license.
    Rate this, if it helps!
    Gilbert

  • Cisco ASA ( Adaptiv Security Algorithm )?

    Hello,
    Im french so sorry for my english , i will do my best to explain my question.
    Im actually working on Cisco PIX 501 ( for school ).
    I have to do some test on it , search what is able to do and how to proove it...
    My question is about Cisco ASA ( Adaptiv Security Algorithm ) , what is it doing? i mean it just simply stop every information coming from outside to inside(security 0 to 100) or is it doing more? is it searching wrong/good packets or just stop everything?and if it's doing that , how it's done?
    My question could be : what cisco ASA doing more than ACL?
    I hope im clear enough in my questions,i search a lot on internet but didnt find an answer.
    Thank you!
    Amaury

    if i understand good what you mean , ASA/algorithm is a part of different processes which are part of stateful inspection
    not really,  I would say that stateful inspection is part of the adaptive security algorithm.  The algroithm goes through processes such as ACL check, NAT..etc. and based on these check makes entries in the state table.
    ( by the way stateful inspection = stateful firewalling , right?)
    Kind of.  Stateful inspection is what the stateful firewall does and not what it is if you can understand that.  A stateful firewall performs stateful inspection.  So stateful inspection is not a firewall.
    when you said "showing tcp  connections and NAT xlate table entries at  the firewall CLI before and  after" , iam ok with that but what are the  command to check table entries? i cant find it.
    show conn protocol tcp will show you the TCP connections through the firewall and show xlate will show you the NAT translation that are currently active.
    Aswell i will need the commands to configure ( if possible ) stateful  inspection and traffic inspection , but i will try search by myself  because i didnt start yet
    Again, stateful inspection is not something you configure but is what the ASA does based on configured rules.  so all you need to do is configure ACLs and NAT rules and routing and the ASA does all the stateful inspection stuff on its own.
    Please remember to rate and select a correct answer

  • Cisco ASA Security Levels

    Hi All
    I have just started working on Cisco ASAs and working on following scenario:
    3 Depts having 3 separate Networks given following names
    Finance
    Accounts
    HR
    Communication Between them should be restricted and allowed on specfic host and services. My approach is that I have assigned security level of "0"
    to each of them and also enabled "same-security-traffic permit inter-interface", so that they can communicate with each other. Now what I have observed is that as soon as I enable same-security-traffic permit inter-interface traffic starts flowing among them without the need for any access-list. But as soon as I create an access list for some specific host , traffic stops flowing for all other hosts except for the one which was granted access in access-list.
    Is my approach right? Please do advise, and also Is this a default behaviour of ASA to implicitly deny traffic for all host as soon as I place a acl after enabling same-security-traffic permit inter-interface.
    Thanks and Regards

    Hello,
    If all of the networks zone have the same security level for your company then you can use the same one on them.
    Remember that all the ACL's have an implicit deny at the bottom, so the behavior is expected.
    Same security level interfaces with the same-security-traffic command will be allow to exchange traffic without the need on an ACL but as soon as you place one on any of those interfaces you will need to specify the traffic you will need to allow.
    Regards,
    Rate all the helpful pots
    Julio
    Security Engineer

  • Cisco asa security context active/active failover

    Hi,                  
    I have two Cisco ASA 5515-X appliance running OS version 8.6. I want to configure these two appliance in multiple context mode mode.
    Each ASA appliance will have two security context named "ctx1" & "ctx2".
    I have to configure failover on these two ASA appliance such that "ctx1" will be active in one ASA box and "ctx2" will be active and process the traffic on second box to achieve this i will configure two failover group 1 & 2. And assign "ctx1" interfaces in failover group 1 and "ctx2" interface to group 2.
    I am a reading a book on failover configuration in active/active in that below note is mentioned.
    If an interface is used as the shared interface between multiple contexts, then all of those contexts need to be in the same failover redundancy group.
    What this means? can someone please explain because i also want to use a shared interface which will be used by "ctx1" & "ctx2". In this case shared interface can be used in failover group 1 & 2 ?
    Regards,
    Nick

    Yout will have to contact [email protected] or open a TAC case in order to have a new activation key generated. They can do that once they confirm your eligibility.

  • Cisco security license cost

    Hi, I'm a network administrator and I wanted to get the security license price for our cisco1941K9. How could I have the cost ?
    Cdlt,
    GKF

    you would need to contact your local Cisco partner for this information or perhaps contact an Online partner.  Follow the links on the following page for more information and ordering.
    http://www.cisco.com/web/ordering/or13/order_customer_help_high_level_listing.html
    Please remember to select a correct answer and rate

  • Security monitoring tool for Cisco ASA

    Please suggest a checp and best security monitoring tool for Cisco ASA devices.

    You can use ossec, open source tool installed on linux:
    http://www.ossec.net/

  • What´s the price for any Cisco ASA security parts?

    Hello everybody,
    Please, I need to know the prices for the items:
    ASA5500X-SSD120=     
    FS-VMW-2-SW-K9       
    L-ASA5525-TAM=       
    I need to implement Cisco IPS with 2 Cisco ASA 5525X.
    Thank you.

    Your local Cisco partner can provide pricing for your area.
    The Cisco Support Community is not the place to request price quotes.
    Please go to www.cisco.com and refer to the top menu pick "How to Buy" to find an authorized partner / reseller serving your area.

Maybe you are looking for