topic FireSIGHT license - ASA IPS in Network Security

FireSIGHT license - ASA IPS

Michel Derycke — Tue, 07 Jul 2015 09:48:37 GMT

Hi,

I'm currently installing a FireSIGHT virtual appliance in order to manage 2 ASA's with FirePOWER services installed.

My Defense Center is properly licensed, using the PAK key I got.

I bought 2 IPS subscription licenses for both ASA's.

I configured the manager on both sourcefire appliances and added them to the defense center.

Now, my problem is: I can't assign any IPS policy because there don't seem to be licenses installed on the DC to apply to the devices...

My question is: do I have to buy additional licenses for the DC for the IPS (Protection) features or do I miss something here? 🙂

Thanks a lot,

Kind regards

What IPS subscription license

Marvin Rhoads — Tue, 07 Jul 2015 15:53:47 GMT

What IPS subscription license (part number or SKU) did you purchase? It would normally be something like "L-ASA5525-TA-1Y" (1 year IPS for 5525 platform).

With that you get a PAK. That PAK plus the license key from the FireSIGHT Management Center / Defense Center is used on the cisco.com licensing portal to obtain the license for the ASAs' FirePOWER modules. You should also have the no cost base Control (CTRL) license that came with the ASAs.

Applying CTRL plus IPS licenses from FMC will get your ASA's ready to have IPS policies applied.

Hi,As Marvin commented, you

dhvenkat — Tue, 07 Jul 2015 17:04:06 GMT

Hi,

As Marvin commented, you will have a CTRL license "ASA5525-CTRL-LIC" sent along with device via a Claim Certificate. On the certificate you should see a PAK number and steps to register it to obtain the license. Please follow these.

If you have purchased a L-ASA5525-TA-LIC=, then this entitles you for obtaining signature updates for PROTECT+CONTROL features. There is no PAK or license for this PID.

- DD

Thanks for the clarification

Marvin Rhoads — Tue, 07 Jul 2015 17:26:12 GMT

Thanks for the clarification DD,

I haven't done an IPS-only in a while. Does redeeming CTRL actually issue you a license with "Features: PROTECT+CONTROL" ?

Hi Marvin,Yes PAK for CTRL

dhvenkat — Tue, 07 Jul 2015 21:35:12 GMT

Hi Marvin,

Yes PAK for CTRL license (ASA5525-CTRL-LIC) provides license for both "PROTECT" and "CONTROL" features.

- DD

Hi All, Thanks for the

Michel Derycke — Wed, 08 Jul 2015 06:19:04 GMT

Hi All,

Thanks for the clarifications.
The ASA came indeed with a CONTROL license, that embed the Protect license.
Quite confusing, though...

DD,Can you clarify this for

jlynch-presidio — Wed, 05 Aug 2015 00:39:29 GMT

DD,

Can you clarify this for me? I'm assisting a customer with an install. I have applied the control license, but if there is not a PAK for the IPS how is the L-ASA5515-TA-LIC= applied? Must the contract number for the license be tied to the same CCO account that the control license was registered to? How will the customer know when the license expires?

Thank you!

Hi,L-ASA5515-TA-LIC= is a

dhvenkat — Thu, 06 Aug 2015 14:31:29 GMT

Hi,

L-ASA5515-TA-LIC= is a Right To use there is no license for this. Customer would have received the IPS (ASA5515-CTRL-LIC) PAK along with the device. On registering the PAK you will get license for "PROTECT+CONTROL" features.

Customer needs to the TA-LIC in order to be legally entitled to receive the signature updates for IPS (PROTECT+CONTROL).

-- DD

DD,I just did an activation

Marvin Rhoads — Fri, 07 Aug 2015 15:00:27 GMT

DD,

I just did an activation today for a 5585-X with TAMC. I found that, at least for those, the Protect+Control licenses aren't being shipped via an eDelivery Product Claim with PAK to the customer. For the lower end appliances with software modules, we seem to be getting eDelivery Claim Certificates with PAKs

Instead, we had to find the PAK in the Cisco ordering system where it was listed as the "serial number" for the "ASA5585-20CTRL-LIC" line item. Once I tracked that down, it worked fine.

Hi Marvin,

S.ashok S — Tue, 12 Jan 2016 11:25:40 GMT

Hi Marvin,

I have installed ASA5515-CTRL-LIC in FMC and the classic license page of FMC showing as never expires for "Protect and Control license". It means customer will get IPS updates forever. Please clarify

Thanks and regards,

Ashok

Cisco does not currently have

Marvin Rhoads — Tue, 12 Jan 2016 13:47:36 GMT

Cisco does not currently have a technical enforcement method (i.e. expiring license) for the IPS updates. However, you are only entitled to download them contractually if you have a current valid subscription.

Hi,

S.ashok S — Tue, 12 Jan 2016 14:06:40 GMT

Hi,

Thank you for your reply.

Customer has taken L-ASA5515-TA-1Y. It means subscription expires after one year.

If yes where can get that details (Expiry date) in FMC.

Thanks and regards,

Ashok Kumar S.

I don't believe it can be

Marvin Rhoads — Tue, 12 Jan 2016 14:13:07 GMT

I don't believe it can be seen in FMC. You need to check entitlement in the Cisco contract records.

Hi Marvin,

Tulipomwene Haukongo — Thu, 13 Jul 2017 14:01:17 GMT

Hi Marvin,

I have a 3 year subscription "L-ASA5525-TA-3Y" but I am unable to enable the IPS module, I get the error below:

Failed opening console session with module ips. Module is in "Unresponsive" state

Could it be that I need the IPS-SSP_5525-k9.x.aip file? The device is no longer on support contract and I need to enable the module, is there any work around it?

Thanks

Tulee

@Tulipomwene Haukongo

Marvin Rhoads — Thu, 13 Jul 2017 14:18:23 GMT

haukongot

That license is for the IPS feature of the FirePOWER module in an ASA 5525-X. The "ips" module is the classic Cisco developed IPS that is now well past end of sales.

You need to have an SSD installed ("show inventory" will confirm it if you are remote) and the "sfr" (Sourcefire now known as FirePOWER) software module installed and up.

The Control license mentioned earlier must also be on hand.

For complete instructions on getting started with the FirePOWER module, please refer here:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html

Re: Hi,As Marvin commented, you

Guillermo Estrada — Thu, 07 Dec 2017 21:16:27 GMT

Hi Team,

Is this still the case? The IPS License/Subscritpion being a RTU license? Customer is concerned because they have no way to telling when their IPS subscription expires. They purchased the firewall/subscription with another partner who lost track of their subscriptions. We're not tasked with sorting this out.