topic Re: ASA + FirePOWER failover licensing in Network Security

ASA + FirePOWER failover licensing

db1 — Fri, 21 Feb 2020 14:17:59 GMT

Hi,

We have 4 offices, each with ASA5516-X running regular ASA software with FirePOWER modules. Those 4 devices are managed by the Management Center running as w VM. All 4 also are licensed for AMP and URL modules.

We are considering adding high-availability to our setup and deploying another ASA5516 on each site in Active / Standby mode, but I am not sure how licensing will work with FirePOWER in that case?

I read on this forum that we will have to configure FirePOWER module on standby firewalls separately, with a different management IP address and add them to the management center, but does that mean we will also have to purchase AMP / URL licenses for those standby units?

Thanks

Jakub

Re: ASA + FirePOWER failover licensing

Marvin Rhoads — Wed, 13 Sep 2017 11:40:57 GMT

Correct - separate Firepower modules require separate licenses.

Cisco is currently offering some bundle discounts for FTD (but not ASA with Firepower module) when you buy multiples together. (That offer is 50% discount on the licensing of the second unit in case any other readers are wondering.)

Re: ASA + FirePOWER failover licensing

db1 — Thu, 14 Sep 2017 06:44:09 GMT

Thanks. Would it be technically possible to run two ASAs in active/standby failover with one of them not having firepower at all? Or just the free Control license? If the main device dies, we will be fine if we don't have URL / AMP protection for a day.

Re: ASA + FirePOWER failover licensing

Marvin Rhoads — Thu, 14 Sep 2017 12:25:41 GMT

Yes - you could do what you ask.

You would need to manage their policies separately since the one without the full license set will not accept the policy elements requiring paid license features.

Re: ASA + FirePOWER failover licensing

apereira3 — Mon, 29 Jan 2018 13:40:14 GMT

Please Marvin,

What are the firewall bundle SKU elegible for the 50% discount on the software subscription licensing of the second unit?

The ASA5516-FTD-K9 is elegible? And ASA5516-FPWR-BUN? I have added at Cisco CCW but the discount doesn't apply to this SKU.

Thank you!

Re: ASA + FirePOWER failover licensing

mikael.lahtela — Mon, 29 Jan 2018 14:32:22 GMT

Hi,

I think the SKU is for FTD only (ASA5516-FTD-HA-BUN).

Here is some more information:

https://www.cisco.com/c/en/us/products/collateral/security/firepower-8000-series-appliances/guide-c07-737902.html#_Toc494406840

br, Micke

Re: ASA + FirePOWER failover licensing

apereira3 — Mon, 29 Jan 2018 14:41:02 GMT

Hi Mikael,

Thank you for your reply.

But when I will configure the PN ASA5516-FTD-HA-BUN at Cisco Commerce Workspace, the pair of software subscription license (L-ASA5516T-T, L-ASA5516T-TM, L-ASA5516T-TC, L-ASA5516T-TMC) has normal price. The second license has the same price of the another, so I would like to know what are the specific bundles that are elegible for this promotion.

Thanks!

Re: ASA + FirePOWER failover licensing

Marvin Rhoads — Tue, 30 Jan 2018 12:08:57 GMT

If your compare the prices for the subscription line items on the BUN SKUs vs. the non-BUN SKUs you will see they are 75% of the normal price.

For example, L-ASA5516T-TMC-3Y is list price US$6480 per device in a bundle vs. US$8640 when part of a single unit order.

Thus two subscriptions for the appliances in a 2-unit bundle cost 1.5x what a single unit would cost. that discount is built into the pricing in CCW and not "added onto" a configuration.