topic Re: License required for Firepower module services in Network Security

License required for Firepower module services

LovejitSingh130013 — Fri, 18 Mar 2022 18:32:11 GMT

Hello Experts @Marvin Rhoads @Rob Ingram @balaji.bandi

They got multiple licenses like Malware (AMP), URL, Malware, Base.

Need to know which one is required for Geo-Blocking ? and blocking multiple domains like xyzlawyers.com etc

also, what does Base license means?

Also, Is there any way to block Applications like we do on Fortigate, like Application Control, which license is required for that?

Thanks,

Re: License required for Firepower module services

Rob Ingram — Fri, 18 Mar 2022 18:51:41 GMT

@LovejitSingh130013

Base is the license that comes with the device and does not require a subscription.

Here is a break down of the features per license:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/licensing_the_firepower_system.html

Re: License required for Firepower module services

LovejitSingh130013 — Fri, 18 Mar 2022 19:02:16 GMT

Thanks @Rob Ingram

When I need to purchase the Smart license, just it needs to purchase with Sfr serial no. or ASA serial no.

Also, My FMC is not even showing Base as licensed. is it normal or it needs some work.

Re: License required for Firepower module services

balaji.bandi — Fri, 18 Mar 2022 20:00:33 GMT

check base License here :

https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/Licensing_the_Firepower_System.html

with IPS you can block geo-based ( make sure you get geo database updated periodically)

If you know the IP address range, you can directly block using ACP

Re: License required for Firepower module services

Marvin Rhoads — Sat, 19 Mar 2022 08:30:13 GMT

Whether you need Smart or Classic licenses depends on the type of devices you are managing.

ASA Firepower service modules use classic licenses. They start with Control + Protect (Free) and add on IPS subscription, Malware and URL Filtering (all paid).

FTD devices (running on either Firepower appliances, VMs or ASA hardware) use smart licenses. They start with Base (free) and add on Threat, Malware and URL Filtering (all paid).

Re: License required for Firepower module services

LovejitSingh130013 — Tue, 22 Mar 2022 14:42:36 GMT

Hello @Marvin Rhoads @balaji.bandi @Rob Ingram

Does TC (Threat + URL) will be enough to perform Geo-blocking?

Thanks,

Re: License required for Firepower module services

Marvin Rhoads — Tue, 22 Mar 2022 16:26:44 GMT

@LovejitSingh130013 yes it will suffice.

Re: License required for Firepower module services

balaji.bandi — Tue, 22 Mar 2022 17:22:43 GMT

yes that should work (if you not able to use ACP to block)