topic Correct, licensing is per WSA in Web Security

Cisco Web Security Appliance Licensing for High Availability

edwardwaithaka — Sun, 28 Jul 2013 06:35:10 GMT

Hi,

I would like to deploy Cisco S170 Web Security Applicance in HA mode.

My question is; What license are avaiable to ensure two appliances work in HA mode?

We have purchased the following licenses and not sure if HA will work;

2 x WSA-S170-K9 WSA S170 Web Security Appliance with Software

250 x WSA-WSP-5Y-S2 Web Premium SW Bundle (WREP+WUC+AMAL) 5YR, 200-499 Users

There are 250 users in our network.

Cisco Web Security Appliance Licensing for High Availability

Ken Stieers — Fri, 02 Aug 2013 15:44:31 GMT

I'm not an expert on the licensing end, but as far as I know, there isn't a seperate license for HA of the WSA. From a technical standpoint, HA for the WSA is handled by how you get the traffic to the boxes. The WSA's don't know about one another, they don't get "clustered" like the ESA's...

Cisco Web Security Appliance Licensing for High Availability

ariswadkar — Sat, 10 Aug 2013 15:05:25 GMT

We've used an ACE or some other type of load balancer for HA.

Cisco Web Security Appliance Licensing for High Availability

Kush Srivastava — Tue, 13 Aug 2013 07:23:07 GMT

HI,

WSA does not have the Clustering Capability. You can however load balance the traffic via WCCP (transparent proxy Deployment) or via PAC files (Explicit Proxy Mode).

Regards,

Kush

I have been going through

amatahen — Tue, 18 Mar 2014 12:19:44 GMT

I have been going through Support community questions and I noticed your question, we have a setup were HA is achieved by using PAC file which is pushed to users.

HTH

Correct, licensing is per WSA

Kyle Bolton — Sat, 22 Mar 2014 01:47:35 GMT

Correct, licensing is per WSA, with no additional licensing needed for HA as provided by WCCP clustering.

We use netscalers to do an

VeNoMouSNZ — Sun, 25 May 2014 23:53:24 GMT

We use netscalers to do an LDNS address sort of like GSLB, which monitors the proxy port, it is sort of a dynamic dns with a low TTL, if the proxy goes down it changes the return address to the alternate ip.. by doing this, we don't have to proxy through the netscaler and use X-FF...

Hello Edward,Please, allow me

alexdelangel — Tue, 30 Sep 2014 15:46:43 GMT

Hello Edward,

Please, allow me to resurect this old post. What method of HA did you implement? According to this conversation, I clearly understand that WSA can not perform a cluster, so we need to load balance according to our WCCP configuration on the ASA.

Now, the question is about licensing. For example, if you did acquire 250 licenses, did you install 125 on WSA-1, and 125 on WSA-2???? Imagine that WSA-1 dies, now you just can use the 125 licenses from WSA-2???

Regards!

When you get the WSAs both

Ken Stieers — Tue, 30 Sep 2014 15:59:06 GMT

When you get the WSAs both boxes get the feature keys, but user count isn't tracked...

So when one fails, the boxes don't care that they're handling more... In a VM world you can create and license as many as you need...

Hi,The licensing portal

edwardwaithaka — Tue, 30 Sep 2014 18:48:12 GMT

Hi,

The licensing portal allows you to generate different licenses for the two appliances both for 250 users. From there, you use WCCP to load share.

Re: Hi,The licensing portal

andresmen598 — Fri, 03 Nov 2017 20:15:20 GMT

Good day,

I would like to know if there is any document showing the step by step to perform load balancing and HA configuration between a WSA and vWSA through WCCP on a Cisco ASA Firewall.

On the other hand I have the doubt when this type of configuration is done as it is done so that when making some configuration change replicate in the two WSA (physical WSA and virtual vWSA).

Thank you in advance for the collaboration and help you give me.

Re: Cisco Web Security Appliance Licensing for High Availability

SamithMadhukalpa5866 — Thu, 24 Feb 2022 06:21:37 GMT

Hi Guys,

What is the meaning of 200-499 Users for licenses?
Is that the number of concurrent users sessions or licensed user limitation?

Please advice.

Re: Cisco Web Security Appliance Licensing for High Availability

balaji.bandi — Thu, 24 Feb 2022 08:13:13 GMT

yes up to 499 unique or concurrent users at a time.

Re: Cisco Web Security Appliance Licensing for High Availability

Ken Stieers — Thu, 24 Feb 2022 12:38:20 GMT

That is the number of unique people that are in the company.

Re: Cisco Web Security Appliance Licensing for High Availability

SamithMadhukalpa5866 — Fri, 25 Feb 2022 05:10:44 GMT

Thanks Balaji and Ken for your reply.

Is there any way that we can check the current utilization of those concurrent users out of 499?

Re: Cisco Web Security Appliance Licensing for High Availability

balaji.bandi — Fri, 25 Feb 2022 09:47:04 GMT

what is the version WSA async code running ?

11.X you can do as below : (User Count Page)

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-5/user_guide/b_WSA_UserGuide_11_5_1/b_WSA_UserGuide_11_5_1_chapter_010011.html