Firepower IPS Subscription

[Garry S]

Hello,

Last year I purchased 6x 5525-x with Firepower and relevant licenses. I also purchased 6x "L-ASA5525-TA-1Y" which I believe is the subscription to Firepower IPS updates. 

A couple of questions, because our Cisco partner, Cisco account manager and TAC are struggling:

How do we know when the Firepower IPS subscriptions actually expire? Is it simply one year from date of purchase or something else? It was over a year ago that we purchased the subscriptions but our Firepower installations are still pulling IPS subscription updates so is the subscription model simply faith-based?

Any advice or insight would be appreciated - I'm trying to work out what I need to buy and everybody is struggling to give me a definitive answer.

Garry

[Philip D'Ath]

Weather it is faith based or not, if you bought 12 months subscriptions a year ago isn't the answer clear?  You need to renew the subscription.

Just buy the same thing again (I think there is a big promo on 3 year subscriptions so check that out as well).

[Garry S]

Philip don't be so condescending. No the answer isn't clear. If it was I wouldn't have asked the question would I? I don't know why people with your attitude bother to hang around on forums - you're extremely unhelpful.

You also failed to answer the majority of my questions.

[Marvin Rhoads]

I'm not positive how they "count" the date on the IPS subscription. PAK-based licenses begin the day you redeem the PAK. Given that the IPS is really only active with the Control license, I'd venture a guess it is tied to redemption of that license. I may be wrong but - see following...

The expiry date for your IPS subscription is found in the Cisco Service Contract Center (CSCC) tool. Unfortunately this particular subscription does not expose that information to the customer administrator at this time. Cisco also does not currently enforce the term though "cutting off" your subscription updates.

Your partner who sold you the subscription (and of course Cisco) can use the CSCC tool to verify your entitlement and associated dates.

[dhvenkat]

For each TA license brought you would have been provided SEULA document emailed to you. This confirms your legal coverage for getting the auto updates for PROTECT and CONTROL license. If someone does not renew the TA license on expiry falls under legal radar. So it is advised to buy TA to obtain automatic updates. On expiry you need to renew it. Failing is legal violation.

http://www.cisco.com/web/products/seula/FirePOWER-services-for-ASA-SEULA.pdf

[Marvin Rhoads]

dhvenkat  

Just so - but the SEULA often goes to someone other than the network admin and even if it does it is often lost or misplaced.

The request from many customers (and partners alike) is that the time period be accessible somewhere in the product interface instead of being accessible only via CSCC.

The SEULA by itself simply states: "The license shall be a subscription to use the Product for a defined period of time as indicated in a SKU or as otherwise shown in the ordering document."

There is also doubt as to whether the "defined period" begins at the time of order fulfillment (i.e. the purchase) or at the time of license fulfillment in the License Administration Portal (https://tools.cisco.com/SWIFT/LicensingUI/Quickstart).

[david brooks]

Did this happen to get resolved?  We're still seeing a lack of consistency between FMC license portal, CSCC and purchase records.  Also, how does one tie a FP subscription to a physcial piece of hardware in environments with a multitude of sites...

[Marvin Rhoads]

dbrooksinsight  ,

Can you be more specific as to the inconsistencies you are asking about? Also tell use whether you are using classic licensing or Smart Licensing.

Generally a license is applied to a particular device as follows:

a. Classic - we copy the FMC license key to the Cisco portal along with the product PAK. We are then issued a license which is installed on the FMC and subsequently aplied to a registered managed device (hardware or virtual).

b. Smart - Once the FMC is registered via token to the Smart Licensing portal, it acts as the proxy to check out and apply licenses to its managed devices.

[mgrecner]

Hello Marvin,

how exactly do I find the FP subscriptions in the CSCC ? Is there a separate contract for that ? How do I find it ? Should I use the serial number of the appliance ? I do not have any PAK for the subscriptions themselves.

How does the subscription get into the CSCC ? Do I need to take any action ? Contact licencing team or something like that ?

Thank you very much

Best regards

Martin

[Marvin Rhoads]

It should show up with the order in CSCC.

If you're a partner please contact your CSCC admin or Cisco's CSCC help desk for support.

[cchubb]

This is a good question Garry.

I just completed an install for a customer who also only purchased the 3yr IPS license and was surprised that it was included with the Control License.  I expected a separate PAK and requirement to register the license but it was not necessary. 

When i look at the licensing page on FireSight, Protection and Control shows "Valid License" and expiry "Never".

Now i'm left wondering what happens in 3 years.

Chris

[Abid Abdul Latif]

in same boat :)