ESA: Which features require a FeatureKey?

[jluebbers]

Hello,

We are looking to replace an old C150 appliance that was purchased back before the Cisco-IronPort acquisition. The only feature we actually use on the appliance is the outbound DKIM message signing - no inbound features at all are required (it's used as an outbound-only MTA in front of webservers to ensure all emitted email meets our published signing policies).

The old device was covered by an IronPort Platinum support contract that has now expired - and for our usage we never needed to license any of the subscription-based antispam, antivirus, encryption, etc. features as basic outbound DKIM signing is included in the base OS feature set.

We're looking at replacing this device with a C170 - but now that the support contracts have all transitioned into the Cisco structure we're finding it hard to know exactly what to purchase to cover our needs. I've found this doc that maps the old-to-new contracts, but it doesn't go into any detail about exactly which features need a featurekey/subscription:

http://www.cisco.com/en/US/services/ps10436/ps11169/ironport-customer-eo-qa.pdf

Is anyone able to clarify some things for me?

1. Is outbound DKIM signing (not inbound DKIM verification) still included in the basic OS featureset?
   
2. Is there a list anywhere that shows in detail which features need a featurekey & subscription?
   
3. Is there a way to get basic AsyncOS updates/hotfixes without having to buy a featurekey subscription?
   

Thanks for any assistance!

Regards,

Jacob

[Andreas Mueller · Accepted solution]

Hi Jacob,

DKIM signing is part of the mail handling feature key, so you got that always covered on new appliances. As for other feature keys, simply imagine where an additional engine is needed to perform a tasks (antispam, antivirus, encryption, DLP).  As there are different features on various models and versions of AsyncOS, there is no general list of feature keys available. Regarding updates, these are part of your support contract and the feature keys you have purchased/running.

Hope that helps,

Andreas

[Bob Fayne · Accepted solution]

I always typed "featurekey" from the CLI to see what was available although I think it might not be a complete list. A cisco sales person or reseller should be able to give you the full scoop on it

I believe that v7.6.1 made a change that an Anti-Spam feature key is now needed for SBRS to work. Not a seperate key, just an Anti-Spam key.

I don't think you can get updates without at least a basic support contract but you get updates that are applicable to any applied feature keys. With no contract at all I think all you will get is basic Incoming Mail Handling (perpetual key) with no OS updates.

[jluebbers]

Thanks Andreas and Bob for your answers. We have been in dialog with a number of resellers both in NA and AP regions and with Cisco directly and no-one seems to know how to sell IronPort products to us. Resellers are responsive but when they go to Cisco to get exact part numbers in order to give us a quote we get a black hole.

It sounds like from your answers though we don't need any additional featurekey to get the DKIM signing - so as long as we have basic SmartNET on the appliance we should be able to get the OS fixes & updates.

Regards,

Jacob