Cisco ASA 5506-X VPN License

[thomer]

I have recently purchased the ASA5506-X. My IT guy has installed it and its up and running fine. However apparently to set up a VPN I need to purchase a licence. Can anyone point me in the right direction to buy one. We are a very small company and don't have a Cisco support contract, we use a local IT company for any work we need doing.

[Marvin Rhoads]

Site to site VPN doesn’t require any additional license. 

Remote access VPN for client PCs requires a separate license. How many remote access users do you have?

[thomer]

Just one remote user (me). We have about 14 internal PC's, but need access to only 5.

[Marvin Rhoads]

For that, the minimum AnyConnect Plus license would suffice. It is available as a term license with associated subscription and offered  for 1-, 3- or 5-year terms. For a 1-year term, the part numbers would be:

L-AC-PLS-LIC= (term license)

L-AC-PLS-1Y-S1 (term subscription)

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

Your local reseller should be able to order it for you easily

[thomer · Accepted solution]

Dealing with Cisco can be an arduous task. You can only buy the license through a reseller. They called me after I made an inquiry, and the tech did not know what these licenses were or how to order them. Said he would call me back in a few minutes. That was almost a week ago :-(

[Marvin Rhoads · Accepted solution]

I know that Cisco doesn’t make it easy for an individual to buy enterprise products.

Some people have reported success in dealing with one of the large resellers who have a big Internet presence - somebody like CDW. 

[Phoneguy-Mike]

---

@Marvin Rhoads wrote:

For that, the minimum AnyConnect Plus license would suffice. It is available as a term license with associated subscription and offered  for 1-, 3- or 5-year terms. For a 1-year term, the part numbers would be:

L-AC-PLS-LIC= (term license)

L-AC-PLS-1Y-S1 (term subscription)

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

Your local reseller should be able to order it for you easily

---

Is there absolutely no way to buy just 1 or 2 licenses? There are less then 25 people in our entire company. Requiring a minimum purchase of 25 doesn't seem very small business friendly to me.

[Marvin Rhoads]

Sorry but Cisco doesn't currently sell any quantity less than 25 licenses.

[grggyoung]

I share your frustration.

[grggyoung]

Could you clarify your sentence?

Both part numbers are required for a valid order. List price is US$150 for 25 users (25 users is the minimum order). ($6/user/year, changing to longer term gives greater discounts: $14.40 and $21 per user/year for 3- and 5-year terms respectively)

You mention $6/user/year for 1 year but then mention if I buy for a longer time period the price is $14 and $21. That doesn't seem correct that would cost more the longer I purchased.

[Phoneguy-Mike]

Hi grggyoung,
It was actually Marvin Rhoads that said that, but what I think he meant was it is $6 per user for the 1 year license, $14.40 per user for all three years of the 3-year license, and $21 per user for all five years of the 5-year license. But again I could be wrong.

Hope that helps.

[Marvin Rhoads]

@Phoneguy-Mike

That's correct.

3 years total cost = 2.4 times one year cost

5 years total cost = 3.5 times one year cost

[Marvin Rhoads]

ASA5506-SEC-BUN-K9 bundle does not include any AnyConnect licenses at all. They are purchased separately.

Your "show version" output indicates the appliance has 50 AnyConnect Premium peers (old name for what now is known as Apex - with a few minor differences). Those licenses do not expire per se but they generally require an active support contract to entitle you to TAC support for AnyConnect, including access to download updated software versions. This is noted on the AnyConnect download page:

"AnyConnect <version> is available to customers with active AnyConnect Apex, Plus or VPN Only term/contracts. See the AnyConnect Ordering Guide for options."

[Max Kalachov]

Hi guys,

I have a similar situation, I'm running ASA 5506 with a base license and I need to increase the amount of client VPN connections.

If I understand correctly the minimum license I can acquire is "AnyConnect Plus" for 25 AnyConnect users. Is this correct?

Also if I understand correctly the "Other VPN Peers : 10 perpetual" will remain the same, therefore my limit of S2S VPN connections will remain the same. Am I right?

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 5 perpetual
Inside Hosts : Unlimited perpetual
Failover : Disabled perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 10 perpetual
Total VPN Peers : 12 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Disabled perpetual

Thank you

Regards,

Max

[Marvin Rhoads]

Correct. If you add the license for 25 AnyConnect peers (either Plus or Apex, the current rough equivalents to old Essentials and Premium), you will have the capability to connect both the 25 AnyConnect sessions plus up to 10 site-site IPsec VPNs at the same time.