topic Re: Cisco ASA 5506-X VPN License in Network Security

Cisco ASA 5506-X VPN License

thomer — Fri, 21 Feb 2020 15:00:32 GMT

I have recently purchased the ASA5506-X. My IT guy has installed it and its up and running fine. However apparently to set up a VPN I need to purchase a licence. Can anyone point me in the right direction to buy one. We are a very small company and don't have a Cisco support contract, we use a local IT company for any work we need doing.

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Thu, 21 Dec 2017 17:17:47 GMT

Site to site VPN doesn’t require any additional license.

Remote access VPN for client PCs requires a separate license. How many remote access users do you have?

Re: Cisco ASA 5506-X VPN License

thomer — Thu, 21 Dec 2017 17:22:39 GMT

Just one remote user (me). We have about 14 internal PC's, but need access to only 5.

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Fri, 22 Dec 2017 02:25:23 GMT

For that, the minimum AnyConnect Plus license would suffice. It is available as a term license with associated subscription and offered for 1-, 3- or 5-year terms. For a 1-year term, the part numbers would be:

L-AC-PLS-LIC= (term license)

L-AC-PLS-1Y-S1 (term subscription)

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

Your local reseller should be able to order it for you easily

Re: Cisco ASA 5506-X VPN License

thomer — Thu, 28 Dec 2017 20:54:05 GMT

Dealing with Cisco can be an arduous task. You can only buy the license through a reseller. They called me after I made an inquiry, and the tech did not know what these licenses were or how to order them. Said he would call me back in a few minutes. That was almost a week ago 😞

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Fri, 29 Dec 2017 01:19:02 GMT

I know that Cisco doesn’t make it easy for an individual to buy enterprise products.

Some people have reported success in dealing with one of the large resellers who have a big Internet presence - somebody like CDW.

Re: Cisco ASA 5506-X VPN License

Phoneguy-Mike — Mon, 10 Sep 2018 12:14:58 GMT

@Marvin Rhoads wrote:

For that, the minimum AnyConnect Plus license would suffice. It is available as a term license with associated subscription and offered for 1-, 3- or 5-year terms. For a 1-year term, the part numbers would be:

L-AC-PLS-LIC= (term license)

L-AC-PLS-1Y-S1 (term subscription)

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

Your local reseller should be able to order it for you easily

Is there absolutely no way to buy just 1 or 2 licenses? There are less then 25 people in our entire company. Requiring a minimum purchase of 25 doesn't seem very small business friendly to me.

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Mon, 10 Sep 2018 17:35:02 GMT

Sorry but Cisco doesn't currently sell any quantity less than 25 licenses.

Re: Cisco ASA 5506-X VPN License

grggyoung — Mon, 08 Oct 2018 21:26:29 GMT

I share your frustration.

Re: Cisco ASA 5506-X VPN License

grggyoung — Mon, 08 Oct 2018 21:31:30 GMT

Could you clarify your sentence?

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

You mention $6/user/year for 1 year but then mention if I buy for a longer time period the price is $14 and $21. That doesn't seem correct that would cost more the longer I purchased.

Re: Cisco ASA 5506-X VPN License

Phoneguy-Mike — Mon, 08 Oct 2018 22:23:24 GMT

Hi grggyoung,
It was actually Marvin Rhoads that said that, but what I think he meant was it is $6 per user for the 1 year license, $14.40 per user for all three years of the 3-year license, and $21 per user for all five years of the 5-year license. But again I could be wrong.

Hope that helps.

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Mon, 08 Oct 2018 22:26:56 GMT

@Phoneguy-Mike

That's correct.

3 years total cost = 2.4 times one year cost

5 years total cost = 3.5 times one year cost

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Wed, 28 Aug 2019 02:07:28 GMT

ASA5506-SEC-BUN-K9 bundle does not include any AnyConnect licenses at all. They are purchased separately.

Your "show version" output indicates the appliance has 50 AnyConnect Premium peers (old name for what now is known as Apex - with a few minor differences). Those licenses do not expire per se but they generally require an active support contract to entitle you to TAC support for AnyConnect, including access to download updated software versions. This is noted on the AnyConnect download page:

"AnyConnect <version> is available to customers with active AnyConnect Apex, Plus or VPN Only term/contracts. See the AnyConnect Ordering Guide for options."

Re: Cisco ASA 5506-X VPN License

Max Kalachov — Thu, 26 Mar 2020 21:18:26 GMT

Hi guys,

I have a similar situation, I'm running ASA 5506 with a base license and I need to increase the amount of client VPN connections.

If I understand correctly the minimum license I can acquire is "AnyConnect Plus" for 25 AnyConnect users. Is this correct?

Also if I understand correctly the "Other VPN Peers : 10 perpetual" will remain the same, therefore my limit of S2S VPN connections will remain the same. Am I right?

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 5 perpetual
Inside Hosts : Unlimited perpetual
Failover : Disabled perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 10 perpetual
Total VPN Peers : 12 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Disabled perpetual

Thank you

Regards,

Max

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Fri, 27 Mar 2020 04:14:00 GMT

Correct. If you add the license for 25 AnyConnect peers (either Plus or Apex, the current rough equivalents to old Essentials and Premium), you will have the capability to connect both the 25 AnyConnect sessions plus up to 10 site-site IPsec VPNs at the same time.

Re: Cisco ASA 5506-X VPN License

ronniedst — Fri, 24 Apr 2020 16:20:19 GMT

Hi Marvin Rhoads,

For the ASA-5506x what is the maximum number of Anyconnect peers can it support? We are planning to provide anyconnect to 250 users. Thanks in advance

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Fri, 24 Apr 2020 17:11:53 GMT

@ronniedst The ASA 5506 will support a maximum of 50 remote access VPN clients.

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

That's a hardware limitation and you cannot exceed that number - the appliance will refuse new VPN connections after 50 are active.

Re: Cisco ASA 5506-X VPN License

ronniedst — Fri, 24 Apr 2020 18:41:52 GMT

Hi Marvin,

Thanks a lot for the reply.

With that I just want to seek your advise on this.

Since our goal is to provide our users with secure remote access to our environment on AWS.

In terms of management what would you recomend, Cisco (NGFWv) or (ASAv)?

https://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-virtual-appliance-asav/white-paper-c11-740505.html

Re: Cisco ASA 5506-X VPN License

Marvin Rhoads — Sat, 25 Apr 2020 08:38:00 GMT

Either one can provide basic remote access VPN perfectly well.

If you want the broadest range of VPN feature support then ASAv is currently a slightly better choice.

If you potentially want to use it for any NGFW/NGIPS features then FTDv would be preferable.

Re: Cisco ASA 5506-X VPN License

hassankash — Fri, 16 Dec 2022 06:11:21 GMT

Hi,

I have ASA5506 with 50 licenses VPN Anyconnect, does this device support additional 50 licenses to make it total of 100 VPN anyconnect ilcenses ?