topic It will need a software in Network Security

Cisco ASA 5515 - X IPS License

vinaypratapsingh08 — Sun, 10 Mar 2019 13:51:42 GMT

Hello Everyone,

I am quite new to the security domain. I have few concerns over ASA5515-X IPS License.

We have purchased ASA5515-K9 with L-ASA5515-TA-1Y - which states FirePOWER IPS 1YR subscription (License included).

I have below concerns:

1). Now my supplier says L-ASA5515-TA-1Y is preinstalled on device, but I cannot see any such license installed on my ASA5515-X.

2). In description, it is mentioned that License included - what does that mean?

4). Can I activate IPS with the license?

5). After purchasing as above, my supplier says in order to use IPS, I need to buy additional license - "L-ASA5515-IPS-SSP - Cisco ASA 5515-X IPS Security Services Processor Software License".

6). Is it possible that L-ASA5515-TA-1Y can be pre-installed with any IPS license?

Thanks your support in advance!

Vinay

Your supplier is not giving

Marvin Rhoads — Wed, 14 Jun 2017 07:35:11 GMT

Your supplier is not giving you good advice.

The type of license you have purchased is a term subscription for IPS service on a FirePOWER module. It need to be used in conjunction with a free (but required) non-expiring Control license that should have been included as a PAK (Product Activation Key) printed on a paper claim form.

You redeem the PAK via ASDM and the Cisco licensing portal and, having done so, you can then configure and apply IPS policies. Note using ASDM requires the FirePOWER module to be at least release 6.0 on the 5515-X. Otherwise you have to install and use a separate FirePOWER Management Center server. (Requires a separate purchase.)

The L-ASA5515-IPS-SSP is an obsolete product and no longer sold. It is for the old style IPS (classic - not FirePOWER) and has not been sold for a year or two.

Hi Marvin,

vinaypratapsingh08 — Wed, 14 Jun 2017 09:34:49 GMT

Hi Marvin,

Thanks for reply, i want to know can i use & configure IPS in ASA5515-K9 with L-ASA5515-TA-1Y License & how to activate IPS module.

Also i see it does not show to have FirePOWER module?

Regards,

Vinay

Please share the output of

Marvin Rhoads — Wed, 14 Jun 2017 13:10:33 GMT

Please share the output of the following commands on the ASA:

show module
show version

please see below outputs:

vinaypratapsingh08 — Wed, 14 Jun 2017 14:41:59 GMT

please see below outputs:

ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 9.2(2)4
Device Manager Version 7.2(2)1

Compiled on Tue 29-Jul-14 23:41 PDT by builders
System image file is "disk0:/asa922-4-smp-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 2 mins 54 secs

Hardware: ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores)
ASA: 4096 MB RAM, 1 CPU (1 core)
Internal ATA Compact Flash, 8192MB
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)
Boot microcode : CNPx-MC-BOOT-2.00
SSL/IKE microcode : CNPx-MC-SSL-PLUS-T020
IPSec microcode : CNPx-MC-IPSEC-MAIN-0026
Number of accelerators: 1
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4

0: Int: Internal-Data0/0 : address is 2c33.1151.4470, irq 11
1: Ext: GigabitEthernet0/0 : address is 2c33.1151.4474, irq 10
2: Ext: GigabitEthernet0/1 : address is 2c33.1151.4471, irq 10
3: Ext: GigabitEthernet0/2 : address is 2c33.1151.4475, irq 5
4: Ext: GigabitEthernet0/3 : address is 2c33.1151.4472, irq 5
5: Ext: GigabitEthernet0/4 : address is 2c33.1151.4476, irq 10
6: Ext: GigabitEthernet0/5 : address is 2c33.1151.4473, irq 10
7: Int: Internal-Data0/1 : address is 0000.0001.0002, irq 0
8: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 0
9: Int: Internal-Data0/2 : address is 0000.0001.0003, irq 0
10: Ext: Management0/0 : address is 2c33.1151.4470, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 100 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 250 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
IPS Module : Disabled perpetual
Cluster : Enabled perpetual
Cluster Members : 2 perpetual

This platform has an ASA 5515 Security Plus license.

Serial Number: FCH2050J7UP
Running Permanent Activation Key: 0x3f39f97f 0xd0c00ee2 0x2d5379e4 0xfa54e0d8 0x8c01cb92
Configuration register is 0x1
Configuration has not been modified since last system restart.

ciscoasa# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515 FCH2050J7UP
ips Unknown N/A FCH2050J7UP
cxsc Unknown N/A FCH2050J7UP
sfr Unknown N/A FCH2050J7UP

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
0 2c33.1151.4470 to 2c33.1151.4477 3.0 2.1(9)8 9.2(2)4
ips 2c33.1151.446e to 2c33.1151.446e N/A N/A
cxsc 2c33.1151.446e to 2c33.1151.446e N/A N/A
sfr 2c33.1151.446e to 2c33.1151.446e N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
ips Unknown No Image Present Not Applicable
cxsc Unknown No Image Present Not Applicable
sfr Unknown No Image Present Not Applicable

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
0 Up Sys Not Applicable
ips Unresponsive Not Applicable
cxsc Unresponsive Not Applicable
sfr Unresponsive Not Applicable

Mod License Name License Status Time Remaining
---- -------------- --------------- ---------------
ips IPS Module Disabled perpetual

It will need a software

Marvin Rhoads — Wed, 14 Jun 2017 14:45:37 GMT

It will need a software upgrade and configuration of the FirePOWER (sfr) module. The procedure is outlined here:

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/reimage/asa-ftd-reimage.html#id_51507

It may also possibly need an SSD if one is not installed already. "show inventory" will tell you that.

Thank you so much for your

vinaypratapsingh08 — Wed, 14 Jun 2017 15:00:11 GMT

Thank you so much for your help!

Can L-ASA5515-TA-1Y subscription with IPS license cannot be used alone without FirePOWER service?

You're welcome.

Marvin Rhoads — Wed, 14 Jun 2017 15:05:18 GMT

You're welcome.

Correct - it requires a FirePOWER module with Control license installed and a management station - either running ASDM (limited capability with FirePOWER 6.0 or later) or FirePOWER Management Center (separately licensed appliance or VM).

The detailed FirePOWER Compatibility Guide can be found here:

http://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#id_38014

Thank You Sir!

vinaypratapsingh08 — Wed, 14 Jun 2017 15:13:15 GMT

Thank You Sir!