topic Apply the PAKs you have to in Network Security

Firepower Module IPS License PAK

rjadhav163 — Tue, 12 Mar 2019 08:33:20 GMT

We are installing a Firepower Module on ASA 5525-X and we will be managing it using Management Center Virtual.

All the licenses are classical licenses and we have purchased a 3 Year IP Subscription L-ASA5525-TA-3Y. However, we did not get any PAK for this License. As per the Quick Start Guide below,

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5500X/5500x_quick_start.html#pgfId-130931

it says:

IPS—This includes entitlement to Rule, Engine, Vulnerability, and Geolocation updates. Note: This right-to use
subscription does not generate a PAK/license activation key for the ASA FirePOWER module.
Other licenses that you can purchase include the following:

Advanced Malware Protection (AMP)
URL Filtering

These licenses do generate a PAK/license activation key for the ASA FirePOWER module. See the Cisco ASA with
FirePOWER Services Ordering Guide for ordering information. See also the Cisco Firepower System Feature
Licenses.
To install the Control and Protection licenses and other optional licenses, see Install the Licenses, page 8.

So now I am confused:

Do I need a PAK or not for IPS 3 Year Subscription? If not, then how do i get and install the license?

Thanks and Regards.

You probably got a PAK for a

Karsten Iwen — Sat, 19 Nov 2016 22:51:48 GMT

You probably got a PAK for a Control-License, this can be used to generate a Control+Protect license. If you have this license, you can use IPS.

i am not exactly sure, but

cofee — Sun, 20 Nov 2016 01:49:09 GMT

i am not exactly sure, but did you guys also procure firesight to manage firepower? If so firesight should have come with PAK and once you have firesight installed you should be able to generate license keys for the IPS from there.

If you use FirePower

Karsten Iwen — Sun, 20 Nov 2016 08:36:02 GMT

If you use FirePower Management Center, then you just apply the licenses to FPMC instead of the ASA itself. It doesn't change the way how and which PAKs you get and how they are issued to the licensing portal.

The only real change with FPMC is, that you also can use Smart Licensing where the licenses are managed cloud-based at Cisco.

Hi Karsten,

rjadhav163 — Sun, 20 Nov 2016 11:10:43 GMT

Hi Karsten,

we got the PAK for Control License. So basically I have PAK for

ASA Control License: ASA5525-CTRL-LIC

FMC Virtual: FS-VMW-10-SW-K9

And we just got SEULA for L-ASA5525-TA=, but no PAK.

So I don't understand how to install the TA 3 Yr Subscription License. Do I need another PAK from Cisco?

Regards,

Apply the PAKs you have to

Karsten Iwen — Sun, 20 Nov 2016 11:43:45 GMT

Apply the PAKs you have to your FMC and you are good to go. The Control-License gives you the technical requirements to run IPS and the TA license gives you the right to use it.