topic You will need to rehost any in Network Security

Devices unlicensed into firesight defense center when added

Fazal E Rasool Khan — Tue, 12 Mar 2019 12:59:45 GMT

Hello Everyone,

I am deploying ASA 5515-X firewall with firepower 5.4 and firesight defense software 5.4 as well.

Customer has vmware 2 device license and URL filtering license. I downloaded the licenses successfully from Cisco website and uploaded into FireSight successfully as shown in attached pic 1.

The issue is when i am trying to add ASA firewall 5515 under devices> devices management, it adds the devices successfully and shows its information like serial no, interfaces names etc. But devices appear as unlicensed and when i try to click on URL license check box its does not become active as shown in attached pic 2.

Kindly advise what could be the issue.

Thanks.

----------------Update------------------
First the added the device (5515) to the Firesight then i added the licenses to the firesight. This is a known issue when licenses are added later.

Looking for the solution.

Fazal,

Marvin Rhoads — Mon, 02 May 2016 03:33:53 GMT

Fazal,

You need to add the no-cost Control license to your customer's FireSIGHT and apply it to the ASA FirePOWER modules. The PAK for it would have been included in the bill of materials with the appliances and is delivered as paper copy. The Control (also known as "Protect+ Control") license is a prerequisite for the IPS, URL or Malware licenses (and associated policies) to work.

If you are the partner or reseller who sold it to them, the Control license can also be viewed in the CCW order fulfillment as a "serial number" associated with the appliances.

If you are unable to locate or retrieve it, please open a TAC case and the Global licensing team can assist.

Thanks for your kind support

Fazal E Rasool Khan — Mon, 02 May 2016 06:18:27 GMT

Thanks for your kind support Marvin. Once i applied control license protection, control and URL licensing become enable.

Dear Marvin,

hasanrajiul086 — Thu, 23 Mar 2017 18:41:56 GMT

Dear Marvin,

Hope you are doing great. I have faced a problem today once i attempted to configure a ASA 5516 Firewall with Firepower services.

I have the control license, IPS and AMP license along with Firesight license. I have downloaded the licenses, extract and upload in ASDM. It says license have been submitted successfully. But when i tried to submit the license for Firesight, it became failed. Another problem is I can see the license status in ASDM, But when i try to see it in Firesight Management center 6.2, it doesn't show any license information. I was unable to see my license status in FMC.

PLs suggest us what shall i need to do.

Regards,

Rajiul

Rajiul,

Marvin Rhoads — Fri, 24 Mar 2017 02:29:28 GMT

Rajiul,

You can only manage a FirePOWER module from one platorm or the other - not both. So if you are using local managment (ASDM) then you cannot use FirePOWER Management Center (FMC).

Also, as of version 6.0, FMC does not require the classic license to be applied to it. If you have one and try to apply it you will get the invalid license type error. You still need a license but it is "right-to-use" and not one that you must (or are able to) install. Newer devices such as FTD do require that you register your FMC with a Smart license via Cisco's licensing portal.

Dear Marvin,

hasanrajiul086 — Sat, 25 Mar 2017 13:54:58 GMT

Dear Marvin,

Thnx for your precious suggestions. Shall i do smart licensing for my ASA 5516 or go with classic licensing? I did see my licenses installed in ASDM as i told before, but i was unable to see it in FMC. So what shall i go now? Does the smart licensing will solve my problem or adding the classic licensing?

Regards,

Rajiul

You will need to rehost any

Marvin Rhoads — Sat, 25 Mar 2017 14:06:03 GMT

You will need to rehost any classic licenses that you had applied using ASDM.

They still need to be classic licenses. ASA FirePOWER service modules only use classic licenses. It is the newer FTD images that use smart licenses.

The only time you use smart licenses with a native ASA is when it is a logical device on a FirePOWER 4100 or 9300 platform.

Dear Marvin,

hasanrajiul086 — Sat, 25 Mar 2017 14:22:39 GMT

Dear Marvin,

THnx for your suggestion. Forgive me if im asking same question again. Actually i am new in this field and this is my first ASA with FP deployment. I didn't see the license status in FMC 6.2 just because i was also logged in ASDM simultaneously or anything else? Shall i add the license in classic mode in FMC again? I have installed the licenses in ASDM before. does it make any impact?

Sorry again for my apology.

Rajiul

You have to choose which

Marvin Rhoads — Sat, 25 Mar 2017 14:42:35 GMT

You have to choose which platform you use to manage the FirePOWER module.

If you use ASDM (local management) you license the module from there and only manage it there.

If you use FMC then you must register the module to FMC via the device management menu and define the FMC registration at the module with the 'configure manager add...' command. Likewise, if you are using that mode, FMC is the one and only place you manage the module.

If you start with ASDM and later decide to use FMC, you must rehost the licenses (via Cisco licensing portal) on FMC and then no longer use ASDM for management of the FirePOWER module.

In both scenarios the licenses are classic licenses.

Dear Marvin,

hasanrajiul086 — Sat, 25 Mar 2017 16:23:06 GMT

Dear Marvin,

Thnx for your kind reply. I have one issue to ask.

I have the ASA 5516 with FP and it is in production now. I do have some policy for traffic and it is deployed in inside, outside and dmz. I want to redirect traffic to firepower now. Shall i do a new service policy or editing existing policy? Does SFR-Fail open in service policy do the tasks? Another issue is shall i add the current network (Subnet) in firepower or firepower add this automatically when the traffic passes through the module? PLs need your suggestion regarding traffic redirection to firepower.

Have a nice time.

Rajiul

We normally use the global

Marvin Rhoads — Sun, 26 Mar 2017 02:35:07 GMT

We normally use the global service policy and match all traffic for inspection by the FirePOWER service module (sfr).

The quick start guide has step by step instructions here:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-150498

For cli instructions, you can see the configuration guide here:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html#anc12

Hi Marvin Rhoads,

naveedusman86 — Fri, 11 Aug 2017 04:44:12 GMT

Hi Marvin Rhoads,

i have ASA 5525X with bundle ,i am facing a problem with license , when i entered the license of firepower via ASDM but when i registers the device in firepower management center it shows unlicensed and disappeared check box of services as well .i highly appreciated your help in this regard.

As noted earlier in this

Marvin Rhoads — Fri, 11 Aug 2017 12:48:14 GMT

As noted earlier in this thread, if you manage with FMC you cannot also manage with ASDM.

This means tha when you switch from one to the other you must also migrate your licenses to the new management system.

So in your case you need to rehost the licenses onto FMC and then assign them to the newly registered sensor (ASA FirePOWER module).