ASR 1000-X series licenses.

[Muhannad Abu Shamma]

Dears,

I need help to understand the AR 1000 licenses.

1) What is the main advantage of the IPSec license (FLASR1-IPSEC-RTU), can the Encryption work without it?

2) I have understood that ordering a Cisco ASR 1000 Advanced IP Services License  (ASR SLASR1-AIS) should have the encryption enabled, if this is correct, why i need to purchase the IPSec license?

3) what is the difference between the Advanced IP Service and Advanced Enterprise Service licences ? Cisco only specifies that the AIS is same to AES but doesn't include "older protocols?

4) I have understood that RTU license is embedded in the Router, does this means that accepting EULA will enable it, but for example if i didn't purchase the IPSec license and then accept the EULA, it will be an evaluation license what will happen when the evaluation period finish?

Regards,

Muhannad

[kohnert11]

Hey, I found that to run Site-2-Site-IPSEC you need the IP Adv. SLASR1-AIS + FLSASR1-IPSEC license.

Do you then have 2.5 GBit IPSEC AES256 throughput and are able to upgrade to 5, 10, 20 GBit in the ASR1001-X via 

FLSA1-1X-2.5-5G   = 5 GBit   or

FLSA1-1X-2.5-10G + FLSA1-BIN-1X10GE = 10 GBit   or

FLSA1-1X-2.5-20G + FLSA1-BIN-1X10GE = 20 GBit IPSEC ? 

..and for more you need ESPxxx ?

Correct?

[John.Mayer]

hello everybody

i just want to know that do i have to buy IPSec license L-FLSASR1-IPSEC if i have Advance Enterprise License on my ASR

as i know right now FLSASR1-IPSEC is not available in CCW under Router ASR1002X and only FLSASR1-FW is available, does FLSASR1-FW support IPSec?

and second as i know both FLSASR1-FW and FLSASR1-IPSEC are RTU

[ugot2nome]

Yes, the IPSEC is an add on license on top of the Advanced IP Services or Advanced Enterprise licenses. The IPSEC is a RTU but it needs to be additionally licensed as well if you want to stick to the honor system. In principle, I disagree the way Cisco does this nor should we have to revisit this topic in late 2019. If someone from Cisco is reading this - please put this confusion to rest by simplifying the licenses on the ASRs. You almost need a CCIE in licensing to understand this. I have used Cisco TAC on multiple occasions and even their answer are at time ambiguous. Digital Transformation & Simplicity starts at home / Cisco.

https://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/guide-c07-731639.html#_Toc7831147

The link above should help. Do bring your decoder ring and be sure to drink your ovaltine

---

@John.Mayer wrote:

hello everybody

i just want to know that do i have to buy IPSec license L-FLSASR1-IPSEC if i have Advance Enterprise License on my ASR

as i know right now FLSASR1-IPSEC is not available in CCW under Router ASR1002X and only FLSASR1-FW is available, does FLSASR1-FW support IPSec?

and second as i know both FLSASR1-FW and FLSASR1-IPSEC are RTU

---

- https://www.youtube.com/watch?v=6_XSShVAnkY

[ugot2nome]

One other clarification - with the 1001-HX & 1002-HX platforms, I don't believe you need a separate IPSEC SKU. You have to first select the crypto module and then choose the encrypted throughput value - this feature is also RTU. You will still need the technology package license - IP Services or Enterprise Services. Always defer to the platform specific hardware installation guide to be your real source of truth based on IOS version.

https://www.cisco.com/c/en/us/td/docs/routers/asr1000/install/guide/1001HX_1002HX/b_ASR1001HX-1002HX_HIG.html

[vlado_avax]

Is it life time or for 1 year?