topic Marvin, a quick one. I read in Network Security

ASA 5506 lic question

Mariusz00001 — Tue, 12 Mar 2019 05:52:48 GMT

1. Will I get ANY subscriptions in ASA5506-SEC-BUN-K9 pls? There is no info o cisco.com and all on-line shops just say it is ASA5506-SEC-BUN-K9...

2. What the difference between ASA5506-SEC-BUN-K9 and asa5506-fpwr-bun. I am after IPS...

3. Is it true that there are no switchports on this firewall?

ASA5506-SEC-BUN-K9 includes

Marvin Rhoads — Mon, 04 May 2015 16:57:54 GMT

ASA5506-SEC-BUN-K9 includes the Security Plus license. The other one does not.

Both include the software module with FirePOWER image pre-loaded and the base Control license (ASA5506-CTRL-LIC). To actually use the FirePOWER IPS features you'd need to add a minimum of the IPS license. (L-ASA5506-TA-1Y for one year, -3Y and -5Y also available).

The 5506 FirePOWER can be managed using ASDM, so a separate FireSIGHT Management Center license is not strictly required (tho advised for greatest functionality).

Both SKUs also include the no-cost ASA 5500 Strong Encryption License (3DES/AES).

Thank you Marvin. What about

Mariusz00001 — Mon, 04 May 2015 16:57:55 GMT

Thank you Marvin.

What about ASA5506-K9 (base license) pls?

Will it support the IPS license later on?

You're welcome.The ASA5506-K9

Marvin Rhoads — Mon, 04 May 2015 17:05:27 GMT

You're welcome.

The ASA5506-K9 (base license) comes with the same licenses as the ASA5506-FPWR-BUN. It even has the same FirePOWER software module image pre-installed and includes the CTRL license.

The difference is when your reseller or partner configures the FirePOWER bundle SKU in the Cisco Commerce Workspace (CCW - Cisco's configuration and ordering tool) they are prompted to add the optional add-on term-based FirePOWER licenses and FireSIGHT Management Center.

Either one can have the IPS license added later - same part number and same cost.

I hope this answers your question. Please mark as answered if it does.

Marvin, a quick one. I read

Mariusz00001 — Tue, 05 May 2015 20:24:20 GMT

Marvin, a quick one. I read somewhere I'd need to add an SSD to run Firepower features. Is it true?

I just bought ASA5506-K9. Does it arrive with an SSD?

I am especially interested in IPS but AMP would be great as well.

Is it enought o purchase L-ASA5506-TA= as you said?

Thx

Yes, it's built-in on all the

Marvin Rhoads — Tue, 05 May 2015 20:42:38 GMT

Yes, it's built-in on all the new SMB ASAs.

The 5506, 5506W, and 5506H all have a 50 Gb mSATA SSD drive (100 GB on the new 5516-X). It's not an option like it is on the larger models (and those use a 120 GB SSD). See table 3 in the data sheet.

Also, they all come with the FirePOWER image preinstalled. You should be able to see the software image as up from the cli with "show module" where you will see a "sfr" module type.

Thx. Appreciate your quick

Mariusz00001 — Tue, 05 May 2015 20:53:28 GMT

Thx. Appreciate your quick reply. My ASA arrives in a couple of days so will play with it

So what is the purpose of

D. STM — Wed, 10 Feb 2016 21:30:09 GMT

So what is the purpose of buying the SEC PLUS, what does it have that the other versions do not, as its more expensive?

Security Plus features are

Marvin Rhoads — Wed, 10 Feb 2016 21:40:27 GMT

Security Plus features are outlined in the tables of the product data sheet:

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

Basically you get the ability to have:

a. more concurrent sessions

b. more site-site and remote access VPN peers

c. more VLANs

d. High Availability (Active-Standby)

So should all Sec-Plus boxes

D. STM — Thu, 11 Feb 2016 14:50:47 GMT

So should all Sec-Plus boxes come with a default feature pack? Is that listed anywhere as to what you get so you can compare it to what you should have.

Marvin do you have the sku

D. STM — Thu, 11 Feb 2016 17:35:06 GMT

Marvin do you have the sku for the FireSIGHT ? So we run the firepower via the 5506, but if we want to run it off the 5506, there is an additional license?

Marvin, I didn't get the L

D. STM — Wed, 09 Mar 2016 13:19:18 GMT

Marvin, I didn't get the L-ASA5506-TA-1Y for 1 year IPS, I picked up a PROMO pack , which is coded as L-ASA5506-TAMC-1PR, Showed it has having IPS, URL, and AMP. So when I got my PAK, and did the license, it only had 2 sets of codes to add, one for URL and one for MALWARE. When I opened a TAC, they said the license feature on the PAK was fine, and MALWARE and URL would be a single file, and that the IPS features is not documented since that license will be updates based on the Protect and Control feature. So my question is would this be the same for IPS if I would of purchased the code you mentioned for just IPS? I haven't worked with the new ASA to much, and I want to make sure I have the IPS features, so I can learn and update my skill set. With the 5505 5510 with the IPS module I thought you ended up with and actual IPS menu on the left column to open, so with the 5506, I don't see anything that states IPS. I do see I have Protect and Control and the other 2 licenses active.

The Protect and Control

Marvin Rhoads — Wed, 09 Mar 2016 13:57:15 GMT

The Protect and Control (included with every ASA with FirePOWER service module) license enables you to use AVC and IPS features on the module.

The IPS license ("TA" - can be combined with other license type and may or may not be part of a "-PR" promo package) is actually a subscription that entitles you to keep your IPS definitions current (i.e. download and apply VDB and Geolocation updates). Confusingly, it isn't enforced via technical means like the old Cisco IPS was. (That product checked your serial number against internal Cisco contract entitlement system.)

See attached, this is clipped

D. STM — Wed, 09 Mar 2016 15:01:09 GMT

See attached, this is clipped from the bottom of my PAK, so wouldn't one conclude that this does, as the vendor told me it does include the subscription? After applying it how will I know its actually active and able to update. The second on shows the URL and MALWARE with subscription end dates, I would expected to see and IPS one there as well.

Yes I agree it would be

Marvin Rhoads — Wed, 09 Mar 2016 15:22:32 GMT

Yes I agree it would be useful if Cisco showed you the subscription status - either in the license, the PAK or anywhere.

Unfortunately they do not currently do so for that particular feature.

Since they do not prevent downloads even without a current valid subscriptions, the only way (that I know of) you can actually find out if your entitlement is current is by asking your vendor to check in the Cisco Service Contract Center (CSCC) portal.

Ok, thank you for the

D. STM — Wed, 09 Mar 2016 15:55:51 GMT

Ok, thank you for the information.

May as well ask, so using the

D. STM — Wed, 09 Mar 2016 16:35:41 GMT

May as well ask, so using the FirePower services on the 5506 vs using the Firesight VM to manage it, is there a big cost to move to the Firesight platform?

The entry level FirePOWER

Marvin Rhoads — Wed, 09 Mar 2016 18:56:17 GMT

The entry level FirePOWER Management Center VMs (2-device and 10-device licenses) are pretty inexpensive at US$500 and US$2000 list price respectively.

If you add Smartnet support (i.e part number CON-SAU-VMWSW2 for example), it's list price is about US$100/year.

Hi Marvin,

Mustak Yunus — Tue, 09 Aug 2016 15:03:02 GMT

Hi Marvin,

I have ASA5506-K9 with base license and unfortunately it only supports 5 VLANs. Is it possible to upgrade the ASA5506-K9 with secure plus license. What is the part number for secure plus license.

Thanks

That would be part number

Marvin Rhoads — Tue, 09 Aug 2016 20:05:23 GMT

That would be part number "ASA5506-SEC-PL".

We typically don't sell a lot of those since the pricing n it usually makes it more attractive to move up to one of the higher models that does not require the separate license for the features provided with Security Plus.