topic FTD is an entirely different in Network Security

Smart licensing problems

Jesper Sorensen — Tue, 06 Dec 2016 11:08:12 GMT

Firesight Management Center (VMware) 6.0.1 which was upgraded from 5.4 with classic licenses and worked without issues.

Now the licenses shows up as "Failed [ node ]" :

Went through the process of converting them to smart entitlements and assigned them to a virtual account:

Assigned that smart license to the management center but the licenses does not show up:

The Firesight Management Center is running version 6.0.0.1, also tried creating a new, seperate, FMC with version 6.1.0 but with the same results.

Any ideas on how to get the subscription licenses to show up as smart licenses in FMC?

Sorry to hijack your thread

Alexander Hartmaier — Tue, 06 Dec 2016 14:01:22 GMT

Sorry to hijack your thread but how did you get the 'Firepower MCv Device License' in the Smart Software Manager?

Although we have installed the Classic FMCv license this pops up as unlicensed and the number of managed devices.

I wasn't able to convert the ' FS-VMW-10-SW-K9' Classic license to a Smart one as the 'Convert to smart entitlements' is greyed out in License tool.

I just did a conversion of my

Jesper Sorensen — Tue, 06 Dec 2016 14:28:45 GMT

I just did a conversion of my "classic" FS-VMW-2-SW-K9 to the new "smart" system.

But I do find it strange that the licenses show up in the "smart" system but are not available on the device.

How did you convert them? As

Alexander Hartmaier — Tue, 06 Dec 2016 14:41:53 GMT

How did you convert them? As said the 'Convert to smart entitlements' is greyed out in the License tool.

I was able to convert them,

Jesper Sorensen — Tue, 06 Dec 2016 15:13:20 GMT

I was able to convert them, as mine wasn´t greyed out im afraid.

Note in your smart license

Marvin Rhoads — Mon, 12 Dec 2016 03:46:02 GMT

Note in your smart license screenshot, it indicates "Threat Defense" licenses. If your ASA is running ASA code (not FirePOWER Threat Defense (FTD) image), you should continue to use classic licenses.

Smart licenses are only used for the new FTD image type. That applies to both 6.0 and 6.1 FirePOWER Management Center when managing/licensing ASA FirePOWER services modules.

You may need to open a TAC case and request the licensing team to convert your licenses back. You will need classic Protect+Control, URL Filtering and Malware licenses.

That makes alot of sense, so

Jesper Sorensen — Mon, 12 Dec 2016 07:53:12 GMT

That makes alot of sense, so would this issue be resolved by updating the ASA code to the FTD image?

What puzzles me is that I would assume the licenses would show up in the FMC regardless of what image the ASA is running.

Can you please also comment

Alexander Hartmaier — Mon, 12 Dec 2016 09:39:39 GMT

Can you please also comment on my issue Marvin? Thanks!

FTD is an entirely different

Marvin Rhoads — Mon, 12 Dec 2016 15:54:48 GMT

FTD is an entirely different image. It does not have complete feature parity with the ASA image and migration from one to the other is a mostly manual process that's not recommended unless your Cisco or partner SE has looked at the setup and recommended it.

Since you had registered your FMC to Cisco Smart licensing it picked up the licenses assigned there. Those licenses are simply not relevant to the ASA FirePOWER Services module. They cannot be used with anything other than an ASA running FTD image.

Technically the FMC does not

Marvin Rhoads — Mon, 12 Dec 2016 15:58:00 GMT

Technically the FMC does not require a license as of version 6.0. It still requires a purchase of the product, but it is not licensed, either with Smart or classic license types.

There may be conditions where and FMC started out as a licensed instance on an earlier 5.x version and that carries forward when it is upgraded to 6.x.

Thanks!

Alexander Hartmaier — Mon, 12 Dec 2016 16:08:34 GMT

Thanks!

Do you know what the 'Firepower MCv Device License' is that the Smart License portal displays as missing?

MCV license is required for

dhvenkat — Mon, 12 Dec 2016 17:20:08 GMT

MCV license is required for Virtual FireSIGHT devices, you need to convert the virtual FireSIGHT license to Smart entitlement.

PID - FS-VMW-SW-K9

Where is this documented?

Alexander Hartmaier — Tue, 13 Dec 2016 08:45:02 GMT

Where is this documented?

I assumed that but failed to do so in the license portal. How can we convert the license and which should be purchase instead of new FMCs to prevent the problem from happening in the first place?

@dhvenkat ,

Marvin Rhoads — Tue, 13 Dec 2016 16:20:07 GMT

dhvenkat ,

Has the following changed?

FIRESIGHT license is not required for FMC 6.0.1 (image which supports Smart). It is already integrated into the SW

Source - your FAQ posting from March 2016

Yes this is correct for all

dhvenkat — Tue, 13 Dec 2016 17:21:07 GMT

Yes this is correct for all FireSIGHT, but MCV license is different which is required for Virtual FireSIGHT devices only. User can obtain the MCV license by converting FS-VMS-SW-K9 PID to Smart.

- DD

@dhvenkat: please see my two

Alexander Hartmaier — Wed, 14 Dec 2016 09:31:45 GMT

@dhvenkat: please see my two questions below, thanks!

It should be in ordering

dhvenkat — Wed, 14 Dec 2016 14:37:28 GMT

It should be in ordering guide or conversion guide for Smart licensing. Try our new VCA tool (beta) to provide answers to questions. This tool is very effective to answers on Smart License.

If you have purchased "FS-VMW-SW-K9" or "FS-VMW-10-SW-K9" or "FS-VMW-2-SW-K9" virtual FireSIGHT then you should be able to convert this PID to Smart to obtain MCV Smart entitlement. You can convert by using below steps,

- Login to LRP and assign your Smart and Virtual account to the PAK for the Virtual FireSIGHT ("FS-VMW-SW-K9" or "FS-VMW-10-SW-K9" or "FS-VMW-2-SW-K9")

- Login to CSSM (Smart Software Manager) select your Smart and virtual account

- Click on License Conversion Tab, you should see the PAK added

- Follow the steps to complete the conversion

Thank you very much @dhvenkat

Alexander Hartmaier — Wed, 14 Dec 2016 16:30:41 GMT

Thank you very much @dhvenkat!

In the 'Convert Licenses' tab of 'Smart Software Manager' the already activated PAK I've assigned to the virtual account showed up and could be converted.

I never looked there because the other license conversions are done in the License Administration Portal.