Firepower license error

[MKH]

Hello

I have purchased cisco L-ASA5515-TAC-3Y license and activated. It must active protection, control and url filtering in my SFR. But when I added license to my FMC, Just url filtering activated. I rechecked my license key from Cisco License Registration Portal and that is true (protection, control and url filtering).

What is the problem? Is there a solution for this problem?

Thank you.

[Marvin Rhoads · Accepted solution]

The Control + Protect license is applied using the PAK that shipped as a physical claim form with the appliance. Once you redeem and add the license you can get using that PAK, you will see all three licenses active.

(Protect or IPS is actually a subscription and not a license per se - it's a bit confusing).

[MKH]

Hello

I have gotten the license by using the PAK. I added the license to the FMC.

But as seen on attachment picture, control and protection aren't activated(Just URL Filtering license is activated).

What can I do?

Is it OK? 

Thank you.

[Marvin Rhoads · Accepted solution]

Have you added the separate Control license?

[MKH]

No, I just added the license with P/N: L-ASA5515-TAC-3Y.

[Marvin Rhoads]

Please refer to my original reply.

You MUST apply the Control license. Until you do, no other licenses will be usable.

[MKH]

I have activated my license key (P/N: L-ASA5515-TAC-3Y) with my FMC license key from cisco portal. I have received one license file from cisco. Then I have added the license file to my FMC. According to cisco documents, It must active three specifications (control+protection+url filtering) together, but just url filtering is activated.

Do I need to purchase another license for control+protection activation?

Can you discuss   “You MUST apply the Control license”  in more detail?

Thank you very much.

[Marvin Rhoads]

All ASAs with FirePOWER services come with and require a no-cost Control license. It is shipped as a paper claim form in a cardboard envelope with the PAK printed on it and included in the box with the ASA.

If you have misplaced that paper, your supplier can retrieve the PAK number from the Cisco ordering system.

That license is in addition to any separately ordered IPS subscription, URL Filtering or Malware (AMP) license. It is NOT the license you received as a result of purchasing the " L-ASA5515-TAC-3Y" part number.

Unless you redeem that PAK for Control license and install the license it gives you, none of the other licensed features will be active.

[MKH]

I really appreciate your help and assistance.

I purchased my ASA  with IPS module (not firepower module). Now I uninstall the IPS module and installed a Cisco FirePower (SFR) module on a Cisco Adaptive Security Appliance.

What can I do now?

Do I get the control license?

 Can I retrieve the PAK number from the Cisco ordering system?

Thank you.

[Marvin Rhoads]

You're welcome.

If you ordered the FirePOWER services bits to convert an older type (IPS, CX or no security module 5500-X series) then you have two options:

- order each required part number separately (SSD, Control License, FirePOWER IPS/URL/AMP term licenses/subscriptions and FirePOWER Management Center) (FMC can be omitted in favor of local (ASDM-based) management but it's not generally recommended.)

- order the upgrade SKU in which case the reselller is prompted for each of the above line items when they validate the bill of materials in Cisco's ordering tool (CCW).

Since it appears you ordered the bits separately but neglected to order the Control license, it can be separately ordered as a no-cost ($0) line item. The part number is "ASA5515-CTRL-LIC" in your case.