topic Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device in Network Security

Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

mohamed_safwat — Sat, 26 Oct 2019 01:21:41 GMT

I have a pair of 4110s, and I had a problem SSHing to the logical ASA's. Having looked at the licensing, it appears that the "Encryption-3DES-AES" is disabled, which is causing it to only accept SSHv1 connections. The problem is, i don't have access to the internet or smart license, show version:

License mode: Smart Licensing

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited
Maximum VLANs                     : 1024
Inside Hosts                      : Unlimited
Failover                          : Active/Active
Encryption-DES                    : Enabled
Encryption-3DES-AES               : Disabled
Security Contexts                 : 10
Carrier                           : Disabled
AnyConnect Premium Peers          : 10000
AnyConnect Essentials             : Disabled
Other VPN Peers                   : 10000
Total VPN Peers                   : 10000
AnyConnect for Mobile             : Enabled
AnyConnect for Cisco VPN Phone    : Enabled
Advanced Endpoint Assessment      : Enabled
Shared License                    : Disabled
Total TLS Proxy Sessions          : 10000
Cluster                           : Enabled

and i tried to request license from licensing portal but it gives error "unknown product type"

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

Marius Gunnerud — Sat, 26 Oct 2019 22:02:03 GMT

What output on the 4110 are you using for the serial number are you using to request the license?

Alternately you could contact cisco licensing@cisco.com an ask for assistance.

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

mohamed_safwat — Sat, 26 Oct 2019 22:44:15 GMT

how to request license and it accepts only smart license. it is not like the old ASA appliances to request PAK file. so what i can tell licensing@cisco.com?

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

Marius Gunnerud — Sun, 27 Oct 2019 08:43:58 GMT

Just give Licensing the serial number of the old and new devices as well as your smart account info and that you need the 3des-AES strong encryption license

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

mohamed_safwat — Sun, 27 Oct 2019 22:49:35 GMT

the problem i don't have access to the internet. actually i don't know why cisco did that. it is not logic to be able to ssh to the device i get license, any other firewalls don't have the same issue. and smart license is the worst thing ever.

@Marius Gunnerud wrote:
Just give Licensing the serial number of the old and new devices as well as your smart account info and that you need the 3des-AES strong encryption license

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

Marvin Rhoads — Mon, 28 Oct 2019 03:06:44 GMT

The license type you need to request is known as Permanent License Reservation (PLR).

You have to request your account be made eligible for this license type as Cisco will do some export control eligibility verifications etc. before approving it.

A PLR license does not require Internet access for the licensed device(s). Setting it up (once approved) is described here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/fxos201/web-config/b_GUI_ConfigGuide_FXOS_201/license_management.html#id_22096

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa logical device

mohamed_safwat — Mon, 27 Jan 2020 08:10:38 GMT

Hello Marvin,

thank you for your reply. it is good solution if we don't have internet access and we have request this license from the beginning before getting the standard license.

thanks,

Re: Encryption-3DES-AES" is disabled on Cisco Firepower 4110 asa

MaclaneMatsuoka — Fri, 12 Apr 2024 13:58:33 GMT

Is Cisco support required for this?

Or if they have a lab unit but no support on it can this still be achieved?