ASA Security+ failover licensing question

[Mark Mattix]

I am trying to pair up 2 5512X firewalls for failover. I have 1 Security+ license and I've read that this license should combine and cover the second device as well. I've configured the primary firewall with the license but the secondary without the license won't let me use the failover command. How do I initially pair these two up so I can use failover on the secondary device?

Thanks for the help!  -Mark

[Vibhor Amrodia]

Hi Mark,

As you can see in the document below:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/intro_license.html#wp2161439

You would need atleast the Security Plus license on the ASA Secondary unit as well to enable failover.

Other features are combined but this feature should be there on both the ASA units.

Thanks and Regards,

Vibhor Amrodia

[Mark Mattix]

Thank you Vibhor, this is what I found on that document:

Typically, you buy a license only for the primary unit; for Active/Standby failover, the secondary unit inherits the primary license when it becomes active. If you have licenses on both units, they combine into a single running failover cluster license.

The exceptions to this rule include:
•Security Plus license for the ASA 5505, 5510, and 5512-X—The Base license does not support failover, so you cannot enable failover on a standby unit that only has the Base license.

-------

So this means a standby 5512X also needs a Security+ license but a firewall like the 5515X would only need the Security+ license on the primary firewall? Thank you!

[Karsten Iwen]

For 5512 and lower (it's the same for 5505, 5510, 5506-X), the SecPlus-License is the prerequisite to enable Failover. For 5515-X and higher, this doesn't apply as there is only the Base-Version which always includes Failover. After both units meet the prerequisites and the FO-system is build, then the other licenses are merged.