ASA 5585-X Licensing

[Ashley Sahonta]

Hi,

I have registered the license purchased for the ASA 5585X appliances and have received the following listed as features.

> Failover : Enabled
> Encryption-DES : Enabled
> Encryption-3DES-AES : Enabled
> Security Contexts : 20
> GTP/GPRS : Disabled
> AnyConnect Premium Peers : Default
> Other VPN Peers : Default
> Advanced Endpoint Assessment : Disabled
> AnyConnect for Mobile : Disabled
> AnyConnect for Cisco VPN Phone : Disabled
> Shared License : Disabled
> UC Phone Proxy Sessions : Default
> Total UC Proxy Sessions : Default
> AnyConnect Essentials : Disabled
> Botnet Traffic Filter : Disabled
> Intercompany Media Engine : Disabled
> 10GE I/O Plus : Disabled

I require 10 GE interfaces and the appliance has been licensed for 10Gb (I think).

Is this something that has to be activated?

[garry cordess]

Hi Andrei,

Its the on-board 10G ports that are affected.

I just built a 5585 and added NM-4-10GE with SR SFP+ without being asked for the SEC license.

Also I have noticed that many of the 5585X's are a bundle that includes the SEC license.

Regards,

Garry.

[Andrei Ciorba]

Thank you for your quick reply. Indeed, bundles with higher-end SSPs already include the SEC license; this license is an option only for the SSP-10.

[amadulin2013]

Hello Marvin & Davwalsh,

Just a quick question, does ASA5585-S40-K9 still required a (ASA5585-SEC-PL: ASA 5585-X Security Plus License (Enables 10G SFP+ Ports) to enable the 10G port? I am bit confused because, upon reviewed the Cisco "ASA Managing Feature License, seems that it is supported by default on ASA5585-S40-K9 package, see details below.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

FEATURE INFORMATION

We introduced the 10 GE I/O license for the ASA 5585-X with SSP-10 to enable 10-Gigabit Ethernet speeds for the

fiber ports. The SSP-40 supports 10-Gigabit Ethernet speeds by default.

Note The ASA 5585-X is not supported in 8.3(x).

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

However when I talked to one of Cisco SE, he told me that the Security Plus License is required and a must to enable the 10GB interface.

For your comment.

Regards,

Arnold

[Marvin Rhoads]

Arnold,

Your reading is correct. Among the 5585-X models, a separate Security Plus license is only required  to enable 10 Gbps interfaces on the -10 and -20 versions. The -40 and -60 models include it by default.

[amadulin2013]

Thanks for the info Marvin, really appreciate it.

[garry cordess]

Hi Marvin,

I have been reading the info here and its been useful except:

The 5585X 10 and 20 need the SEC Plus lic to activate 10G ports - right?

But is a SEC Plus required on both 5585's in an HA pair?

Regards,

Garry

[Marvin Rhoads]

Garry,

In an HA pair of 5585-X (with SSP-10 or SSP-20) running ASA software 8.3 or later only one of the units needs to have the Security Plus license purchased and activated in order to use the 10 Gbps ports.

[garry cordess]

Hi Marvin,

Thanks for the response.

Is this unique to the ASA5585?

The ASA5505, 5510, 5512 need the Security lic per ASA in an HA pair?

Regards,

Garry.

[Marvin Rhoads]

Correct, Garry.

Since the Security Plus license is required to enable failover at all on the 5505, 5510 and 5512X, you need it on both units in a failover pair.

5585-X (no matter which SSP) all support failover even without Security Plus license. So only one of the units needs it to enable the 10 Gbps interface support.

[garry cordess]

Perfect, thanks Marvin.

Regards,

Garry.

[Marvin Rhoads]

You're welcome. Please rate helpful posts.

[supportdxb11]

Hi All .....Need to know ASA5585-S10X-K9  come with ASA5585-SEC-PL    ASA 5585-X Security Plus License  or need to purchase separately ..for Enabling  10G SFP+ Ports

[garry cordess]

Hello,

Being a techy in a re-seller I have just put the SKU ASA5585-S10X-K9 into the Cisco CCW tool.

And it looks like the license ASA5585-SEC-PL (for 10G port activation) is now not a selectable item but is a default item!

The SEC license was a charged item that had to be selected but now its listed at zero cost as default.

Hope this helps,

Garry,

[garry cordess]

I have attached the Bill of Materials, I have deleted the costs but the column named Included Item show the SEC-PL on line 1.9 as Included. And is at zero cost.

All the NO's in the Included Item column are selected such as software and power cable etc.

[garry cordess]

Line Number	Item Name	Description	Service Duration	Included Item	Quantity
1.0	ASA5585-S10X-K9	ASA 5585-X Chas with SSP10,8GE,2SFP+,2GE Mgt,2 AC,3DES/AES	N/A	No	1
1.0.1	CON-OSP-A85S1XK9	SNTC-24X7X4OS  ASA 5585-X Chas with SSP10,8GE,2SFP,2GE	12.0 month(s)	No	1
1.1	ASA5585-BLANK-HD	ASA 5585-X Hard Drive Blank Slot Cover	N/A	Yes	2
1.2	ASA5585-BLANK-F	ASA 5585-X Full Width Blank Slot Cover	N/A	Yes	1
1.3	SF-ASA-X-9.1-K8	ASA 9.1 Software image for ASA 5500-X Series,5585-X & ASA-SM	N/A	No	1
1.4	CAB-BS1363-C19-UK	BS-1363 to IEC-C19 14ft UK	N/A	No	2
1.5	ASA5585-PWR-AC	ASA 5585-X AC Power Supply	N/A	Yes	1
1.6	ASA-SSP-10-INC	ASA 5585-X SSP-10 with 8GE,2SFP, incl with bundle	N/A	Yes	1
1.7	ASA5500-ENCR-K9	ASA 5500 Strong Encryption License (3DES/AES)	N/A	Yes	1
1.8	ASA5585-PWR-AC	ASA 5585-X AC Power Supply	N/A	Yes	1
1.9	ASA5585-SEC-PL	ASA 5585-X Security Plus License (Enables 10G SFP+ Ports)	N/A	Yes	1