ASA software updates without service contract

[huhwatnou]

How can I obtain an Anyconnect VPN Client that works on Windows 8 x64? v2.4.1021 was shipped with an ASA bought last year and it does not connect. No service contract was purchased. Without this update the device is useless for the purposes it was purchased for. Is a service contract really needed? If so, please consider including it into the pricing.

Asked earlier on http://www.facebook.com/CiscoSmallBusiness.

[huhwatnou]

Managed to chat with someone from Cisco. You need a service contract costing 100 euros for what I think is basic service and would like my suppliers to offer for free/incorporate in their pricing. If I had known this in advance, I would not have chosen Cisco.

[Marvin Rhoads]

I'm sorry you're unhappy with your experience. As with all products, your leverage is greatly diminished post-purchase. With any non-commodity product there is a burden on the purchaser to exercise due diligence in researching the capabilities and limitations of what they're buying.

The ASA and AnyConnect products are very full-featured, but without a service contract, you don't have software update entitlement. The service contract gives you not only updates but unlimited Technical Assistance Center (TAC) support so 100 euros is actually a great deal.

[samileh]

I agree with Huh Watnou, the Service Contract should be included into the Hardware purchase or at least resellers should mention that it must be separately purchased.

I just purchased the ASA 5505 and I have been a whole day trying to get upgraded the Firewall as it has quite old software (8.2(5)). I just noticed that I don't have Service Contract!

Why they deliver the product with old software? and not able to upgrade it without Service Contract!

The idea was with this 5505 model that I would learn the configuration before we change all our Firewalls to X-series. Currently we are using Watchguard Firewalls.¨

I am Network admin and my opinion about the product is valuable for management when making decisions. Currently Cisco as Firewall is looking not so good to me.

btw

I am newbie with Cisco and I don't understand Cisco way of documenting. A lot of text with small font. Manuals are hard to understand, too much useless information. Maybe it is not so hard for native english.

Documents could be easier to read. Clear step by step instructions starting from the god damn Service Contract and leave details for those who are interested of it.

Have been in education ASA courses already, but need to rethink if CheckPoint would do better.

[Marvin Rhoads]

It sounds like your reseller didn't serve you well.

In any case the 5505 is not the best example to learn from since it uses VLAN interfaces and a built-in switch that is unique to that model. So even if you had the latest software, it would have some differences with how it operates from the 5500-X series. Any 5512/15/etc.-X will have at least 8.6 software since that is the minimum required for that hardware.

I have used Cisco, Checkpoint, Juniper (Netscreen and SRX) and other firewalls over more than 15 years. I have consistently found Cisco's documentation (and service - which is not free) to be superior. In addition to the numerous official support documents there is also the wealth of information on this community forum provided by thousands of users from all over the world.

No complex product with lots of features is perfect and that applies to firewalls as well as other devices.

[samileh]

Hello,

I actually bought that ASA from the resellers eshop, without asking an offer from them.

Maybe if I had asked an offer from them, they would tell me about the Service Contract.

Anyway, I got already reply from our Vendor and got the license. Price was 54,65€/VAT0%, not bad. That price could even be added into the hardware price and still it would be cheap.

Yes, I agree with the support. They are fast to reply. Not so much experience yet though.

But I have to disagree with the documentation, with same arguments I wrote above.

I have ordered a book, hoping if it would be any better:

The Accidental Administrator: Cisco Asa Security Appliance: A Step-By-Step Configuration Guide

The course which I had was teached with ASA 5505 model. I hope it doesn't differ much of X-series, otherwise I will be screwed as the migration from Watchguard to Cisco should take only couple of months with all testings. But I believe the logic is same in both Cisco series?

There are no simulator for X-series? I guess not, it is so new product.

Thanks your reply

Sami

[Marvin Rhoads]

There's no perfect simulator for the ASA. Some people like using GNS3 and you can get it to run newer ASA code (if you have legitimate access to a current image - anyone posting ASA code image is violating the EULA) by following this guide.

The syntax is 98% the same between 5505 with same level of code (i.e. 9.0 or 9.1) as a 55xx-X with the primary difference being VLANs vs. physical interfaces and some features not being available on the 5505. The 5505 VLANs will mean your config isn't 1-1 transferable.

If you have the support contract, I'd go with ASA software 9.0(3) on your 5505. Also load up the latest ASDM (management GUI image) while you're at it.

[jdanise1028]

You would think at the prices we pay for the equipment the contract would be included but you know, gotta keep the revenue stream going anyway you can. I used to be a total Cisco shop but moving away from them.

Sending the device back and my vendor is not even going to charge me a restocking fee. Will be using Fortinet and comes with support.

[Fred SM]

I do have a large amount of comments on all of the above, but I'll just stick to: It answered my question "No service contract = no software update" Cheers, much appreciated.