topic You need software for the in Network Security

ASA 5510 Failover & Licensing

edw — Tue, 26 Mar 2019 00:58:01 GMT

Hi,

I have recently been given a second ASA 5510 firewall and was wondering how the licensing works for using this in a failover solution ?

I already have a ASA 5510 firewall which has Security Plus license and is under maintenance and wanted to try to understand the mud pile which is licensing as there seems to be conflicting information from Cisco Partners regarding this.

Also is it possible in a failover configuaration to have one internet connection on one firewall and another on the other firewall and this failover based on internet connection stats rather than just fialover the firewall itself ?

Thanks

Hello!

Boris Uskov — Tue, 09 Feb 2016 11:04:51 GMT

Hello!

To use failover you need to have SEC Plus license on boths ASAs. SEC Plus license gives you an opportunity to configure Active/Standby and Active/Active failover.

To use IPS redundancy, from my point of view, it is better to connect both ISPs to every ASA in failover. You can configure dual ISP on ASA, using this guide:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118962-configure-asa-00.html

Thanks for this - thats not

edw — Tue, 09 Feb 2016 11:14:30 GMT

Thanks for this - thats not actually a bad idea.

License wise how does this work if I have been given the ASA 5510 ??

So, I advice you to contact

Boris Uskov — Tue, 09 Feb 2016 11:50:19 GMT

So, I advice you to contact with your local Cisco Partner/Reseller and order the following license:

L-ASA5510-SEC-PL=
ASA 5510 Security Plus License w/ HA, GE, more VLANs + conns

After getting the Product Activation Key (PAK) you'll install the license to your new ASA and you'll be able to connect two ASAs in failover configuration.

Thanks - and if the firewall

edw — Tue, 09 Feb 2016 12:03:57 GMT

Thanks - and if the firewall already has the PAK then its fine to use it ?

If you mean, PAK for SEC Plus

Boris Uskov — Tue, 09 Feb 2016 12:07:39 GMT

If you mean, PAK for SEC Plus license, sure, you can just use it on
www.cisco.com/go/license
and get license-key.

Sorry I meant the firewall

edw — Tue, 09 Feb 2016 12:15:22 GMT

Sorry I meant the firewall already has the license when I got it.

Ah, ok, no problem. So no

Boris Uskov — Tue, 09 Feb 2016 12:26:23 GMT

Ah, ok, no problem. So no additional licenses are required. You can try to configure failover.

So this doesn't break any

edw — Tue, 09 Feb 2016 12:30:01 GMT

So this doesn't break any licensing conditions or restrictions.

So this doesn't break any

edw — Tue, 09 Feb 2016 12:30:05 GMT

So this doesn't break any licensing conditions or restrictions?

There is one thing, I forgot

Boris Uskov — Tue, 09 Feb 2016 12:37:54 GMT

There is one thing, I forgot to mention. If you have IOS version 8.3 and higher - no problem, the majority of licenses will be copied from first ASA to the second one. For example, if you have Anyconnect Essentials and Anyconnect mobile licenses on the first gear, you don't need to buy them for the second ASA in failover.

But, if your IOS version is 8.2 or lower, you need to have absolutely identical set of license on both gears to be able to make a failover.

If we speak about newer gears, for example ASA 5512, ASA5515, those gears can be equipped with additional software modules: older CX module (already End-of-SALE), or newer SFR (SourceFIRE) module. For those additional software modules you have to buy separate set of licenses for every ASA in failover.

OK - so all I need is the

edw — Tue, 09 Feb 2016 12:47:13 GMT

OK - so all I need is the hardware for the second one and not worry about the license ?

I was given the firewall by another charity and just trying to move around the minefield that is Cisco licensing.

Thanks again

You need software for the

Boris Uskov — Tue, 09 Feb 2016 12:49:33 GMT

You need software for the first and the second one to be higher then 8.3 version. What is the software version of the first ASA?

8.4(6) on the first one which

edw — Tue, 09 Feb 2016 14:31:31 GMT

8.4(6) on the first one which we bought and has a software update contract on.

I have the latest 9.1 to put on soon.

Ok, great, so you can upgrade

Boris Uskov — Tue, 09 Feb 2016 14:33:19 GMT

Ok, great, so you can upgrade the first one and the second ASA to 9.1 and create a failover pair. No issues with licenses.

Excellent thanks for you help

edw — Tue, 09 Feb 2016 14:58:12 GMT

Excellent thanks for you help!