topic FTD PAYG licensing in AWS to enable AES256 Encryption in Network Security

FTD PAYG licensing in AWS to enable AES256 Encryption

smithy-au — Tue, 27 May 2025 01:33:55 GMT

I'm trying to test a FTD in AWS. I'm using the PAYG AMI (ami-04d7dfdc0d700e259). I assumed it would include the required licensing as it a PAYG. Fortinet, PAN, F5 etc include the licensing with their PAYG AMIs.

When I try to add a new IKEv2 policy using AES256, I get the following error: "Usable cryptography types are currently restricted by the licensing status of the device"

How do I enable the full license for the PAYG instance? I need to test an IPSec scenario and only need the device for a few days. It's currently using an Evaluation license - how do I make it use the hourly PAYG license from AWS?

Re: FTD PAYG licensing in AWS to enable AES256 Encryption

ahollifield — Tue, 27 May 2025 12:41:56 GMT

You need to register the device to your Smart Account.

Re: FTD PAYG licensing in AWS to enable AES256 Encryption

smithy-au — Wed, 28 May 2025 05:36:17 GMT

But I don't have one. I would have thought the PAYG would cover the license and the compute.

So I need to register for a Smart Account for testing a PAYG instance?

I'm using Terraform to build and automate - can the Smart License also be automated?

Re: FTD PAYG licensing in AWS to enable AES256 Encryption

smithy-au — Wed, 28 May 2025 07:31:21 GMT

This is hopeless. I guess I'll stick with my Forti.

Re: FTD PAYG licensing in AWS to enable AES256 Encryption

ahollifield — Wed, 28 May 2025 12:03:39 GMT

No. But it's not about the license. It's about the export control features. Cisco must make sure you are a company who is able to and located in a geography that is allowed to use advanced encryption algorithms.

Re: FTD PAYG licensing in AWS to enable AES256 Encryption

Aref Alsouqi — Thu, 29 May 2025 09:55:53 GMT

Just to add to what @ahollifield mentioned, the actual licenses will be included in the PAYG subscription, for instance malware, URL filtering, etc will be included without having to buy any smart licenses. However, you still need a smart account to be activate it before you can register the device and it's actually a prerequisite as you can see in the link below:

Cisco Secure Firewall Threat Defense Virtual Getting Started Guide, Version 7.2 and Earlier - Deploy the Threat Defense Virtual on AWS [Cisco Secure Firewall Threat Defense Virtual] - Cisco