ASR1001-HX MACSEC licenses

[rcenar94]

Hi,

I want to configure ASR1001-HX for MacSec.

Are MacSec licenses (FLSA1-MACSEC10G) sufficient?
Or do I need to install ASR1001HX-IPSECW with RTU tier-based license(s) for maсsec to work?

[Georg Pauwen]

Hello,

MacSec license appears to be suffcient, according to the feature guide linked below:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/macsec/configuration/xe-16-6/macsec-xe-16-6-book/wan-macsec-mka-support-enhance.html#reference_963BF82200F442CEB878A31097BA2ECF

[rcenar94]

Hi Georg,
Thanks for your reply.
I'm confused because I have compared the configuration guides and there are differences.
According to the feature guide linked below:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/macsec/configuration/xe-3s/macsec-xe-3s-book.html
<<Wan MACsec requires a separate MACsec license in addition to the crypto license. Ensure that you have both licenses for this feature to work. >>
I have not found any information in the release notes about what was changed in the licensing but in the 17 release there is not this requirement.

[Georg Pauwen]

Hello,

that is confusing indeed. It looks like they changed the requirement based on the IOS train. Your document refers to the 3.x train.

Unless somebody else here can come up with a definitive answer, you might as well contact global support (link below)...

https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html