topic ASA 5585-X Licensing in Network Security

ASA 5585-X Licensing

Ashley Sahonta — Mon, 11 Mar 2019 23:03:01 GMT

Hi,

I have registered the license purchased for the ASA 5585X appliances and have received the following listed as features.

> Failover : Enabled
> Encryption-DES : Enabled
> Encryption-3DES-AES : Enabled
> Security Contexts : 20
> GTP/GPRS : Disabled
> AnyConnect Premium Peers : Default
> Other VPN Peers : Default
> Advanced Endpoint Assessment : Disabled
> AnyConnect for Mobile : Disabled
> AnyConnect for Cisco VPN Phone : Disabled
> Shared License : Disabled
> UC Phone Proxy Sessions : Default
> Total UC Proxy Sessions : Default
> AnyConnect Essentials : Disabled
> Botnet Traffic Filter : Disabled
> Intercompany Media Engine : Disabled
> 10GE I/O Plus : Disabled

I require 10 GE interfaces and the appliance has been licensed for 10Gb (I think).

Is this something that has to be activated?

ASA 5585-X Licensing

Marvin Rhoads — Mon, 07 May 2012 14:50:32 GMT

What version of ASA software are you running? There is a bug (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti70859) in 8.2(3) that shows similar behavior.

ASA 5585-X Licensing

Marvin Rhoads — Mon, 07 May 2012 16:49:23 GMT

...by the way Security Plus license is required to use the 10 Gbps ports:

ASA5585-SEC-PL ASA 5585-X Security Plus License (Enables 10G SFP+ Ports)

Re: ASA 5585-X Licensing

Marvin Rhoads — Mon, 28 Jan 2013 17:48:51 GMT

...and by the way, on an HA pair you only need one Security Plus license for the pair to activate the 10 Gbps interfaces on a 5585-X with SSP-10 (assuming 8.3 or later code)

ASA 5585-X Licensing

davwalsh — Mon, 10 Jun 2013 21:37:09 GMT

That is not the case, except for 5585-X, the Sec Plus license is required on BOTH units in an HA configuration.

ASA 5585-X Licensing

amadulin2013 — Mon, 30 Sep 2013 09:52:33 GMT

Hello Marvin & Davwalsh,

Just a quick question, does ASA5585-S40-K9 still required a (ASA5585-SEC-PL: ASA 5585-X Security Plus License (Enables 10G SFP+ Ports) to enable the 10G port? I am bit confused because, upon reviewed the Cisco "ASA Managing Feature License, seems that it is supported by default on ASA5585-S40-K9 package, see details below.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

FEATURE INFORMATION

We introduced the 10 GE I/O license for the ASA 5585-X with SSP-10 to enable 10-Gigabit Ethernet speeds for the

fiber ports. The SSP-40 supports 10-Gigabit Ethernet speeds by default.

Note The ASA 5585-X is not supported in 8.3(x).

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

However when I talked to one of Cisco SE, he told me that the Security Plus License is required and a must to enable the 10GB interface.

For your comment.

Regards,

Arnold

ASA 5585-X Licensing

Marvin Rhoads — Mon, 30 Sep 2013 14:02:21 GMT

Please note my post specificially says I am talking about the 5585-X with SSP 10.

ASA 5585-X Licensing

Marvin Rhoads — Mon, 30 Sep 2013 14:18:00 GMT

Arnold,

Your reading is correct. Among the 5585-X models, a separate Security Plus license is only required to enable 10 Gbps interfaces on the -10 and -20 versions. The -40 and -60 models include it by default.

ASA 5585-X Licensing

amadulin2013 — Mon, 30 Sep 2013 14:26:22 GMT

Thanks for the info Marvin, really appreciate it.

ASA 5585-X Licensing

garry cordess — Fri, 08 Nov 2013 10:22:24 GMT

Hi Marvin,

I have been reading the info here and its been useful except:

The 5585X 10 and 20 need the SEC Plus lic to activate 10G ports - right?

But is a SEC Plus required on both 5585's in an HA pair?

Regards,

Garry

ASA 5585-X Licensing

Marvin Rhoads — Fri, 08 Nov 2013 12:56:14 GMT

Garry,

In an HA pair of 5585-X (with SSP-10 or SSP-20) running ASA software 8.3 or later only one of the units needs to have the Security Plus license purchased and activated in order to use the 10 Gbps ports.

ASA 5585-X Licensing

garry cordess — Fri, 08 Nov 2013 13:35:13 GMT

Hi Marvin,

Thanks for the response.

Is this unique to the ASA5585?

The ASA5505, 5510, 5512 need the Security lic per ASA in an HA pair?

Regards,

Garry.

ASA 5585-X Licensing

Marvin Rhoads — Fri, 08 Nov 2013 13:39:06 GMT

Correct, Garry.

Since the Security Plus license is required to enable failover at all on the 5505, 5510 and 5512X, you need it on both units in a failover pair.

5585-X (no matter which SSP) all support failover even without Security Plus license. So only one of the units needs it to enable the 10 Gbps interface support.

ASA 5585-X Licensing

garry cordess — Fri, 08 Nov 2013 13:43:06 GMT

Perfect, thanks Marvin.

Regards,

Garry.

ASA 5585-X Licensing

Marvin Rhoads — Fri, 08 Nov 2013 13:44:05 GMT

You're welcome. Please rate helpful posts.

When deployed in a HA pair,

Gary Geihsler — Wed, 18 Mar 2015 16:12:31 GMT

When deployed in a HA pair, according to Cisco, the Security Plus license does not failover. That being the case, if you want the 10G ports enabled on the standby unit both would need the license.

Is the Security Plus license

Andrei Ciorba — Tue, 14 Apr 2015 11:00:50 GMT

Is the Security Plus license required on the SSP-10 also for using the 10GE ports on the additional IO modules, like ASA5585-NM-4-10GE, or is it only required for the on-board 10GE ports?

Many thanks.

Yes - it is required to use

Marvin Rhoads — Tue, 14 Apr 2015 12:51:47 GMT

Yes - it is required to use 10 Gbps ports on either the base unit or the additional IO modules.

Hi Andrei,Its the on-board

garry cordess — Tue, 14 Apr 2015 12:52:09 GMT

Hi Andrei,

Its the on-board 10G ports that are affected.

I just built a 5585 and added NM-4-10GE with SR SFP+ without being asked for the SEC license.

Also I have noticed that many of the 5585X's are a bundle that includes the SEC license.

Regards,

Garry.

Thank you for your quick

Andrei Ciorba — Wed, 15 Apr 2015 09:11:03 GMT

Thank you for your quick reply. Indeed, bundles with higher-end SSPs already include the SEC license; this license is an option only for the SSP-10.