cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

3274
Views
5
Helpful
7
Replies
Highlighted
Beginner
Beginner

ASA + FirePOWER failover licensing

Hi, 

We have 4 offices, each with ASA5516-X running regular ASA software with FirePOWER modules. Those 4 devices are managed by the Management Center running as w VM. All 4 also are licensed for AMP and URL modules. 

 

We are considering adding high-availability to our setup and deploying another ASA5516 on each site in Active / Standby mode, but I am not sure how licensing will work with FirePOWER in that case?

 

I read on this forum that we will have to configure FirePOWER module on standby firewalls separately, with a different management IP address and add them to the management center, but does that mean we will also have to purchase AMP / URL licenses for those standby units? 

 

Thanks

Jakub

Everyone's tags (3)
7 REPLIES 7
Highlighted
Hall of Fame Guru

Re: ASA + FirePOWER failover licensing

Correct - separate Firepower modules require separate licenses.

 

Cisco is currently offering some bundle discounts for FTD (but not ASA with Firepower module) when you buy multiples together. (That offer is 50% discount on the licensing of the second unit in case any other readers are wondering.)

Highlighted
Beginner
Beginner

Re: ASA + FirePOWER failover licensing

Thanks. Would it be technically possible to run two ASAs in active/standby failover with one of them not having firepower at all? Or just the free Control license? If the main device dies, we will be fine if we don't have URL / AMP protection for a day. 

Highlighted
Hall of Fame Guru

Re: ASA + FirePOWER failover licensing

Yes - you could do what you ask.

 

You would need to manage their policies separately since the one without the full license set will not accept the policy elements requiring paid license features.

Highlighted
Beginner

Re: ASA + FirePOWER failover licensing

Please Marvin,

 

What are the firewall bundle SKU elegible for the 50% discount on the software subscription licensing of the second unit?

 

The ASA5516-FTD-K9 is elegible? And ASA5516-FPWR-BUN? I have added at Cisco CCW but the discount doesn't apply to this SKU.

 

Thank you!

Highlighted
Enthusiast

Re: ASA + FirePOWER failover licensing

Hi,

 

I think the SKU is for FTD only (ASA5516-FTD-HA-BUN).

Here is some more information:

https://www.cisco.com/c/en/us/products/collateral/security/firepower-8000-series-appliances/guide-c07-737902.html#_Toc494406840

 

br, Micke

Highlighted
Beginner

Re: ASA + FirePOWER failover licensing

Hi Mikael,

 

Thank you for your reply.

 

But when I will configure the PN ASA5516-FTD-HA-BUN at Cisco Commerce Workspace, the pair of software subscription license (L-ASA5516T-T, L-ASA5516T-TM, L-ASA5516T-TC, L-ASA5516T-TMC) has normal price. The second license has the same price of the another, so I would like to know what are the specific bundles that are elegible for this promotion.

 

Thanks!

Highlighted
Hall of Fame Guru

Re: ASA + FirePOWER failover licensing

If your compare the prices for the subscription line items on the BUN SKUs vs. the non-BUN SKUs you will see they are 75% of the normal price.

 

For example, L-ASA5516T-TMC-3Y is list price US$6480 per device in a bundle vs. US$8640 when part of a single unit order.

 

Thus two subscriptions for the appliances in a 2-unit bundle cost 1.5x what a single unit would cost. that discount is built into the pricing in CCW and not "added onto" a configuration.