ASDM Intrusion, Malware, Securily Intelligance wont log to Real Time Eventing

[michael]

After two weeks working a case with TAC, It has been explained to me that "IPS Software Sensors" shown in the ASDM's "Product Licensing" area is a "Dunsel" entry. In addition to that, the screenshot attachment that shows I have (0) quantity "IPS Sensor Licenses installed" has no useful purpose and should be ignored. This is in regards to the ASA5506X with FirePOWER Services. 

Attached is the screenshot of my ASDM FirePOWER Dashboard. Could someone please explain why CDW Part #: 3617294 cost more money then CDW Part: 3620455 or CDW Part: 4082935 ? And should I be looking to obtain some money back for the "IPS" services license missing from the CDW License product I purchased for my ASA5506?  Please see below and refer to the Licensing area in the screenshot attached to this post.  

 Thank you...

Michael J Demirdjian

cross every t

--------------------------------------------------------------------------------------------------------------------------------------------------------------------

These are the three buying options I paid for the $404.99 option see invoice.

As can be seen in my uploads to the tac case.   Can only activate AMP and URL Filtering not IPS / Apps

Cisco ASA with FirePOWER Services IPS, Apps, AMP and URL Filtering – subscr

CDW Part #: 3617294 | Mfg Part #: L-ASA5506-TAMC-1Y

$404.99

Header
	Brand:		Cisco
	Compatibility:		PC
	Manufacturer:		Cisco Systems
	Model:		IPS, Apps, AMP and URL Filtering
	Packaged Quantity:		1
	Product Line:		Cisco ASA with FirePOWER Services

Cisco ASA with FirePOWER Services Advanced Malware Protection - subscriptio

Mfg. Part: L-ASA5506-AMP-1Y | CDW Part: 4082935 | UNSPSC: 43233204

$271.99

Header
	Brand:		Cisco
	Compatibility:		PC
	Manufacturer:		Cisco Systems
	Model:		Advanced Malware Protection
	Packaged Quantity:		1
	Product Line:		Cisco ASA with FirePOWER Services

Cisco ASA with FirePOWER Services IPS and URL Filtering - subscription lice

Mfg. Part: L-ASA5506-TAC-1Y | CDW Part: 3620455 | UNSPSC: 43233204

271.99

Header
	Brand:		Cisco
	Compatibility:		PC
	Manufacturer:		Cisco Systems
	Model:		IPS and URL Filtering
	Packaged Quantity:		1
	Product Line:		Cisco ASA with FirePOWER Services

[Marvin Rhoads]

IPS is a subscription service and does not have a PAK-based license file associated with it.

As long as you have the no-cost non-expiring base Protect and Control license, have purchased the IPS subscription service and that subscription is current you are entitled and should be able to create and deploy policies that use the IPS features (as well as download new rule updates, VDBs etc.).

Cisco enforces the IPS license usage via your agreeing to the term and conditions - not via technical means (like it does with the URL Filtering and Malware licenses).

[michael]

I reread your post.. Are you saying I need to buy a separate IPS Service subscription for the 5506x to make the (0) into a (1), is that correct?

Do I need (Mfg. Part: L-ASA5506-TA-1Y | CDW Part: 3615590 | UNSPSC: 43233204) in addition to  (CDW Part #: 3617294 | Mfg Part #: L-ASA5506-TAMC-1Y) ???

Michael

------------------------------------------------------------------------------------------------------

Cisco ASA with FirePOWER Services IPS - subscription license (1 year)

Mfg. Part: L-ASA5506-TA-1Y | CDW Part: 3615590 | UNSPSC: 43233204

https://www.cdw.com/shop/products/Cisco-ASA-with-FirePOWER-Services-IPS-subscription-license-1-year/3615590.aspx

----------------------------------------------------------------------------------------------------

[Marvin Rhoads · Accepted solution]

The TAMC license you have includes the IPS subscription. No additiopnal license is needed to get the full feature set.

I'm not sure what that "IPS Software Sensors" line is referring to in your screenshot. I don't have an ASDM-managed FirePOWER module handy to compare.

[michael]

Marvin, Thank you!!!!

[michael]

Hi Marvin,

Thank you for utilizing your time to address my concerns. I do not want to belabor this subject further however I am hoping you will help me to understand something. In the image I uploaded to this forum it shows (0) IPS Software Sensors licensed. In the simplest way possible can you tell me how I can make the (0) turn into a (1) ? In my example above I have purchased and deployed CDW Part #: 3617294 | Mfg Part #: L-ASA5506-TAMC-1Y. And I am receiving the updates and policy modifications as you describe. The control and protect is successfully installed. However the more I work with my sfr firewall aplicience the more I believe that URL Filtering, Malware and et cetera are not singing in concert with the IPS Service.

Maybe I am not seeing the big picture and forgive me if I am not. But thank you for any extra enlightenment you can shed to my concern.

Michael

[michael]

Hi Marvin,

I felt it important to let you know after updating to the latest release ASDM Version 7.8(1)150 Security Intelligence in "Real Time Eventing" started logging "ip block's"   :) AWESOME!!!

ty