Cisco ASA FirePOWER with FireSIGHT Subscription License

[tholmes]

Hello All,

I've just installed a pair of ASA5512X series firewalls with FirePOWER software modules.

(actually, I installed one new one and upgraded an existing with SSD, IOS 9.2.2 and Security Plus)

All went very well and I registered one of the FirePOWERs with the FireSIGHT, adding a basic security policy, non-blocking, monitor-only

My questions are...

1. I've set the pair up for Active/Standby, the new ASA came with an ASA5500 Control License with a PAK code, which I applied to the FireSIGHT and it registered the ASA's FirePOWER without a problem, but do I need a separate Control License for the Standby ASA/FWR - I'm guessing yes?

2. The customer has bought a 3 year signature subscription license,  L-ASA5512-TA= Cisco ASA5512 FirePOWER IPS License
as well as a Smartnet contract, I've been sent the license but there is no PAK key, how do I apply the 3 year subscription to the FireSIGHT.

Any help appreciated.

Regards Tony

[Michael ONeil]

Tony,

I just went through this with a pair of 5555x.

The new hardware should have come with the Control license in the regular Cisco Sealed envelope.

The IPS, URL and Malware licenses come in electronic format to the end user or Cisco Partner.

The FireSight license for the FMC comes with the hardware if purchased or electronic if it’s a VM device.

Licenses: for 5555

ASA5555-CTRL-LIC=           Cisco Protect+Control license PID

L-ASA5555-TAMC=           Cisco ASA5555 FirePOWER IPS, AMP and URL Licenses
L-ASA5555-TAMC-3Y         Cisco ASA5555 FirePOWER IPS, AMP and URL 3YR Subs

FS-VMW-10-SW-K9           Cisco FireSight License for Virtual FMC

[tholmes]

Hi Michael,

Many thanks for the prompt reply...

The new hardware should have come with the Control license in the regular Cisco Sealed envelope.

......Yes got that and it registered the FirePOWER on the FireSIGHT without a problem.

The FireSIGHT license for the FMC comes with the hardware if purchased or electronic if it’s a VM device.

.... Yes got this too and applied it to the FireSIGHT without a problem

I only received this L-ASA5512-TA

L-ASA5555-TAMC-3Y         Cisco ASA5555 FirePOWER IPS, AMP and URL 3YR Subs ----- Did this come as a PAK code?

Regards Tony

[Michael ONeil · Accepted solution]

Yes this did have a PAK: L-ASA5555-TAMC-3Y

Michael O’Neil, Systems Engineer

Phone: (804) 525-2005 | moneil@sycomtech.com

1802 Bayberr-y Court, Suite 201, Richmond, VA 23226

[tholmes]

That's great, many thanks Michael, I thought I was missing something

Cheers Tony

[Rodrigo Belo]

Hi Michael, Anthony,

Can you guys please let me know if the FirePOWER licenses/subscriptions are shared for Active/Standby and/or Active/Active deployments?

I'm about to upgrade an active/standby pair of ASA to support FirePOWER and I'm just not sure on how many licenses/subscriptions I need to purchase.

I've heard both answers from marketing people..."you need 2subscriptions, 1 per device"..."you need only 1 subscription because it's shared on the HA pair" ???

The way I see it is that I need 2 control licenses (that come with the hardware SSD module) plus 1 shared FirePOWER subscription...?? Am I right?

I really need to hear from someone that got their hands on it

Thanks

[Michael ONeil]

The are not shared.

Michael O'Neil (DROID)