Firepower Module IPS License PAK

[rjadhav163]

Hi 

We are installing a Firepower Module on ASA 5525-X and we will be managing it using Management Center Virtual.

All the licenses are classical licenses and we have purchased a 3 Year IP Subscription L-ASA5525-TA-3Y. However, we did not get any PAK for this License. As per the Quick Start Guide below,

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5500X/5500x_quick_start.html#pgfId-130931

it says:

IPS—This includes entitlement to Rule, Engine, Vulnerability, and Geolocation updates. Note: This right-to use
subscription does not generate a PAK/license activation key for the ASA FirePOWER module.
Other licenses that you can purchase include the following:

Advanced Malware Protection (AMP)
URL Filtering

These licenses do generate a PAK/license activation key for the ASA FirePOWER module. See the Cisco ASA with
FirePOWER Services Ordering Guide for ordering information. See also the Cisco Firepower System Feature
Licenses.
To install the Control and Protection licenses and other optional licenses, see Install the Licenses, page 8.

So now I am confused:

Do I need a PAK or not for IPS 3 Year Subscription? If not, then how do i get and install the license?

Thanks and Regards.

R

[Karsten Iwen]

You probably got a PAK for a Control-License, this can be used to generate a Control+Protect license. If you have this license, you can use IPS.

[cofee]

i am not exactly sure, but did you guys also procure firesight to manage firepower? If so firesight should have come with PAK and once you have firesight installed you should be able to generate license keys for the IPS from there. 

[Karsten Iwen]

If you use FirePower Management Center, then you just apply the licenses to FPMC instead of the ASA itself. It doesn't change the way how and which PAKs you get and how they are issued to the licensing portal.

The only real change with FPMC is, that you also can use Smart Licensing where the licenses are managed cloud-based at Cisco.

[rjadhav163]

Hi Karsten,

we got the PAK for Control License. So basically I have PAK for

ASA Control License:   ASA5525-CTRL-LIC

FMC Virtual: FS-VMW-10-SW-K9

And we just got SEULA for L-ASA5525-TA=, but no PAK.

So I don't understand how to install the TA 3 Yr Subscription License. Do I need another PAK from Cisco?

Regards,

R

[Karsten Iwen]

Apply the PAKs you have to your FMC and you are good to go. The Control-License gives you the technical requirements to run IPS and the TA license gives you the right to use it.