Access control policy inheritance and licensing

[Antonio Macia]

Hi,

We have a hierarchical access policy where the parent policy is applied to some firewalls and child policy to others. On the parent policy we have some rules with IPS functionality enabled and all the firewalls associated to the parent policy have the corresponding Threat license.

On the other hand, we have another child firewall policy without any IPS rule targeting a different firewall thas has no Threat license. I get a licensing issue when deploying because this firewall is inheriting the parent policy even thought the rules with IPS policy has nothign to do with the child firewall. Any way to have a child firewall attached to a child policy without licensing issues? I trying to reduce the number policies, having a single one.

Regards.

[Ben Weber]

Hey @Antonio Macia,

Unfortunately, as far as I know, child policies inherit the requirements from the parent policy, which means that you would need to obtain a Threat license for the new firewall. Even if the child policy isn't using the IPS enabled parent policies, the use of IPS policies mandates the attachment of a Threat license for all devices receiving child policies. 

I can't find this explicitly laid out in any Cisco doc, but I am pretty sure that this is how it works.