Setting up Firepower Management Center Virtual + FTD for a noob

JordanRoger40159 · ‎12-08-2019

Hello,

I am trying to setup some Cisco products for the first time and am having trouble and many questions due to my lack of knowledge.

I was forwarded an email from the reseller that contains a link to obtain an e-delivery to a PAK file for the Cisco Firepower Management Center Virtual Appliance. I mistakenly opened this link while signed into my personal cisco profile that is not associated with a Cisco service / smart account. Now when I go to https://software.cisco.com and open traditional licensing for my account. Is the PAK stuck on being associated with my account only now? I am working on getting a Cisco account that is tied to my organization right now; when I do the correct account, am I able to open the email that contained the e-delivery PAK link and get key reregistered to a different Cisco account instead of my personal one? I didn’t actually convert the PAK to a license yet; I only opened the email that the reseller sent me that contains the PAK.

The PAK/Token for the FMC licenses shows up in my profile. It says that the status is unfulfilled and the licenses used are at “0” while there are 50000 available. I attached an image showing this.

I don’t have access to another Cisco account that is tied to my organization right now, but when I do get one, am I able to open the email that contained the PAK and get the token reregistered to a different account instead of my personal one? I didn’t convert the PAK to a license yet; I only opened the email that the reseller sent me that contains the PAK. I looked up the instructions to license the FMC here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/licensing_firepower_system.html#id_79783

The FMC hasn’t been registered to the firepower threat defense devices yet. Is there a difference between using the License Registration Portal or the Cisco Smart Software Manager? Additionally, do I need a master Cisco smart account when registering the device or can I just have an account associated with the organization?

So assuming I received a Cisco Smart Account, I would sign in to the Smart Account and open the PAK file and convert it? Then I would deploy the virtual appliance in VMware and register the license for the FMC under the "System Button" with a token that I created on the cisco smart account page?

Finally, I have two firepower 2100 series devices. After doing the initial setup dialog wizard for both devices where I assign the devices an IP address and point them to the FMC address, I would register the two devices on the FMC with the registration key? I have been following the process with this video series and just want to ensure I have the steps correct: https://www.youtube.com/watch?v=actfQyUKS78

I’m very new to the whole Cisco registration process and am completely lost. I appreciate the guidance and help very much. Thanks for being a helpful community.

Marvin Rhoads · ‎12-08-2019

FMC can use a PAK, a Smart License or both.

An FMC PAK license is only needed if it will manage other devices that also use PAKs (ASA with Firepower services or Classic NGIPS devices (i.e., old Sourcefire appliances that are currently branded as Cisco).

An FMC Smart license is needed if it will manage Smart license-only devices (like Firepower Threat Defense).

If either the PAK or Smart License get assigned incorrectly organization-wise you will likely need to open a case with Cisco licensing (email licenses@cisco.com) to get it fixed.

Re this:

The FMC hasn’t been registered to the firepower threat defense devices yet. Is there a difference between using the License Registration Portal or the Cisco Smart Software Manager? Additionally, do I need a master Cisco smart account when registering the device or can I just have an account associated with the organization?

The former is for PAKs and the latter for Smart licenses. Smart licenses should be assigned to the organization which your CCO ID is associated with - it is not assigned to your account personally (unless you are the sole proprietor of the organization or something like that).

As noted already, PAK to Smart license conversion needs to be done in the backend system by Cisco Licensing team.

Re this:

After doing the initial setup dialog wizard for both devices where I assign the devices an IP address and point them to the FMC address, I would register the two devices on the FMC with the registration key?

Yes you use a matching key you've chosen on both the device and the FMC. Once a device is registered with FMC, you allocate the required license(s) to it.