topic Re: Firepower 2140 VPN Support/Licensing in Network Security

Firepower 2140 VPN Support/Licensing

Jim Matuska — Tue, 12 Mar 2019 14:05:24 GMT

We just purchase a couple 2140 NGFW's with Threat and Malware license subscriptions. I noticed there is a RA VPN license activation that is showing by default as disabled by user.

Without buying additional licensing with the base license and Threat and Malware subscriptions will we be able to setup L2TP Client VPN configurations as well as site to site IPSec VPN's on the 2140's?

Jim

Re: Firepower 2140 VPN Support/Licensing

nspasov — Wed, 14 Nov 2018 19:07:37 GMT

Hi Jim-

The RA-VPN licenses require AnyConnect (Plus or Apex) subscription. However, those are only for RA-VPN. If you want to configure Site-to-Site VPN (IPSec) you don't need to purchase any additional licenses.

I hope this helps!

Thank you for rating helpful posts!

Re: Firepower 2140 VPN Support/Licensing

Jim Matuska — Wed, 14 Nov 2018 19:15:10 GMT

Are L2TP VPN Clients still supported in Firepower like on the older ASA's?

Jim

Re: Firepower 2140 VPN Support/Licensing

Marvin Rhoads — Thu, 15 Nov 2018 02:01:02 GMT

Remote access L2TP VPN clients are not supported on FTD.

We can pass their traffic through (via prefilter) but not terminate it.

Re: Firepower 2140 VPN Support/Licensing

Jim Matuska — Thu, 15 Nov 2018 18:23:00 GMT

Is there any VPN Client software supported to connect without a special license requirement or would we have to buy licensing for RA VPN? We are looking at less than a dozen VPN Client users.

Jim

Re: Firepower 2140 VPN Support/Licensing

Abheesh Kumar — Thu, 15 Nov 2018 21:04:51 GMT

Hi,

FTD supports Any connect Client VPN & IPSec Site to Site VPN.

Old client vpn will not support in FTD. For remote access VPN you need to buy Anyconnect Plus (L-AC-PLS-LIC=) or Apex (L-AC-APX-LIC=) license. Minimum license count is 25.

HTH

Abheesh

Re: Firepower 2140 VPN Support/Licensing

Jim Matuska — Thu, 15 Nov 2018 21:22:57 GMT

What is the difference between the Plus and Apex VPN Client/licensing?

Re: Firepower 2140 VPN Support/Licensing

Abheesh Kumar — Thu, 15 Nov 2018 21:32:24 GMT

Hi,

AnyConnect PLUS

* VPN functionality for PC and mobile platforms, including per-app VPN on mobile platforms.
* Basic endpoint context collection (Note: NOT full ISE context support).
* IEEE 802.1X Windows supplicant.
* Cisco Cloud Web Security agent for Windows & Mac OS X platforms.
* Cisco Web Security Appliance support.
* FIPS compliance.

AnyConnect APEX

* Everything that’s included in AnyConnect Plus.
* Clientless (browser-based) VPN termination on the Cisco ASA.
* VPN Compliance/Posture agent in conjunction with the Cisco ASA.
* Unified Compliance/Posture agent in conjunction with the Cisco ISE 1.3 or later.
* Next Generation Encryption/Suite B.

Below is the cisco link for anyconnect FAQ

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html

HTH

Abheesh

Re: Firepower 2140 VPN Support/Licensing

k.nandakumar — Fri, 16 Nov 2018 06:40:04 GMT

AS of now, when running RA VPN on FTD, there is no difference between AnyConnect Plus, Apex or VPN-Only. You can buy any of these license and get same result.

Re: Firepower 2140 VPN Support/Licensing

Marvin Rhoads — Fri, 16 Nov 2018 07:56:50 GMT

Even though the feature limitations are not enforced via technical means, you are still required to operate per the terms of the End User License Agreement (EULA).

So you have to buy the license type and quantity that meets your requirements and operate accordingly.

Re: Firepower 2140 VPN Support/Licensing

NeWGuy1109 — Mon, 25 Nov 2019 13:56:50 GMT

Does Cisco 4100 with FTD logical device require any additional licensing for multiple Site - Site VPN tunnels ?

Thanks

Re: Firepower 2140 VPN Support/Licensing

Marvin Rhoads — Mon, 25 Nov 2019 15:12:57 GMT

@NeWGuy1109 no it doesn't.

It will support the maximum number per the hardware constraints with the base license installed.

Re: Firepower 2140 VPN Support/Licensing

NeWGuy1109 — Mon, 25 Nov 2019 17:33:15 GMT

Thanks.. how can i find out the maximum number for it ?

Re: Firepower 2140 VPN Support/Licensing

nspasov — Mon, 25 Nov 2019 17:48:43 GMT

You can check the official data sheet for this:

https://www.cisco.com/c/en/us/products/collateral/security/firepower-2100-series/datasheet-c78-742473.html

Thank you for rating helpful posts!