FirePOWER Threat Defense - Smart Licensing FAQ's

[dhvenkat]

What are the FirePOWER ASA models which can support Firepower Threat Defense Image upgrade?

Following are the ASA FirePOWER models which can support Cisco Smart licensing                                             

• ASA5506W
• ASA5506
• ASA5506H
• ASA5508
• ASA5516
• ASA5512
• ASA5515
• ASA5525
• ASA5545
• ASA5555
• FPR9300
• FPR4110
• FPR4120
• FPR4140
• FPR4150

What is process to upgrade to Smart license on FirePOWER?

In order to upgrade to Smart, FireSIGHT/Defense Center needs to be upgraded to new FMC 6.0.1 SW version. There is no FIRESIGHT license in FMC 6.0.1. Add new ASA FirePOWER sensor or upgrade existing ASA FirePOWER sensor with Firepower Threat Defense image. Convert any unfulfilled PAKs to Smart entitlements using “Convert SMART” functionality on LRP. Use CSSM to convert partial device conversion to Smart.         

Where can I download the SW for FMC 6.0 and Firepower Threat defense?

SW for FMC 6.0 and FirePOWER Threat Defense can be downloaded from CCO download page. Reach to your Cisco contact for more information.

I tried to upgrade SW on my FireSIGHT device from 5.4 SW to FMC 6.0.1 but it failed

This can be related to HW and SW image dependency. Capture the error and please reach out to Cisco TAC for more help.

I tried to upgrade my ASA FirePOWER device from SW 5.4 to Firepower Threat Defense image but it failed

This can be related to HW and SW image dependency. Capture the error and please reach out to Cisco TAC for more help.
 

How can I convert my traditional ASA FirePOWER license to Smart entitlements?

• Login to LRP with CCO ID
• Add the PAK to their CCO ID, with Add New PAKs/Tokens option
• On mouse over to the PAK, click on the options view and select "Convert to Smart entitlements"
• Assign the Smart Account and Virtual Account
• PAKs once converted to Smart cannot to converted back
• Click Submit

My tried to convert an Unfulfilled ASA FirePOWER PAK to Smart entitlements but it failed ?

Verify if the PAK is already fulfilled inside the system. You can convert fulfilled PAKs to Smart entitlements. If the PAKs are unfulfilled and if it still fails please reach out to Cisco GLO for more support

Tried to convert a fulfilled ASA FirePOWER PAK to Smart entitlement and it failed ?

Conversion from traditional license PAK to Smart entitlements are allowed for only unfulfilled PAKs in FirePOWER. You can try to partial device conversion to convert the licenses already installed on the device from LRP.

• Login to LRP with CCO ID
• Click on Devices Tab
• Select the device or use filter option to search for particular device using license-key of the device
• On mouse over to the licenses, click on the options and select "Convert to Smart entitlements"
• Select the licenses and submit

Note: You can convert licenses on a device to Smart only if all the licenses on the devices are smart convertible licenses. If there are any licenses which can be converted to Smart the conversion will fail.

How can I add my FMC device to my Smart Account ?

• Login to CSSM portal with CCO ID, select your Smart account
• Select on Inventory tab on the portal, click on New Token
• Copy the Token information
• Login to FMC, on the management console add the device token

How to convert unfulfilled ASA FirePOWER PAK to Smart entitlements ?

• Login to LRP with CCO ID
• Add the PAK to their CCO ID, with Add New PAKs/Tokens option
• On mouse over to the PAK, click on the options view and select "Convert to Smart entitlements"
• Assign the Smart Account and Virtual Account.
• PAKs once converted to Smart cannot to converted back
• Click Submit

What features available on ASA Firepower Threat Defense sensor ?

For ASAFirePOWER sensor with Firepower Threat defense image support smart license for

• BASE
• URLFilter
• Advanced MALWARE (AMP) license
• IPS term subscription
• Advanced LE/SP features
• Strong Crypto

BASE license replaces the "PROTECT+CONTROL" license in SMART

Can we have only ASA Smart features on ASA FirePOWER threat defense image ?

ASAFirePOWER threat defense image support both ASA license  and FirePOWER license. All ASA features are turned on default on ASA FirePOWER threat defense imgage.

What are the new FirePOWER Models that support smart license ?

FPR4110, FPR4120, FPR4140, FPR4150, FPR9K

what features support smart license for FPR 4100 and FPR 9300 series ?

For FPR 4100 and FPR9300 we support smart license for BASE, URLFilter and Advanced MALWARE (AMP) license, IPS, Advanced LE/SP features, Strong Crypto

What is FMC?

FireSIGHT also called as "Defense Center" can be upgraded to new SW version FMC 6.0. Once it is upgraded it is called FMC (Firepower Management Center)

Can FMC support both Smart and traditional Licenses?

Yes FMC can support both Smart license and traditional license

FireSIGHT upgrades to FMC failure?

This can be related to HW and SW image dependency

Want FIRESIGHT traditional License to convert to Smart license?

FIRESIGHT license is not required for FMC 6.0.1 (image which supports Smart). It is already integrated into the SW

[Jonathan Bayless]

So... even though the license cannot be used in the FMC when you set it up, you need to purchase FS-VMW-2-SW-K9, and convert it to Smart license entitlement before assigning it to the hardware device ID license key of the FMC that you have installed? And then it will automatically be used by the FMC once you use the Product Instance Registration Token to associate the FMC with your Smart license profile, right?

[dhvenkat]

In this case, you can convert the SKUs to Smart entitlements before assigning to the device. Once the device is converted and attached to the Smart account it should consume the license automatically.

- DD (SW Licensing Cisco)

[Jonathan Bayless]

OK thanks, in the future I will make sure to convert to smart entitlement first when working with FTD and FMC

[Michael Wollner]

Hi Jonathan,

why i need a license for the FMC? Cisco writes the following on his website:

" Cisco Firepower Management Center Data Sheet - Cisco

Ordering information

Licensing

Starting with version 6.0, license keys are no longer required to use the Cisco Firepower Management Center. Versions 5.4 and earlier will still require a Product Authorization Key (PAK) or smart key. Upgrading to version 6.0 will alleviate that need."

http://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html

Can you explain?

regards,

Michael

[Marvin Rhoads]

[@michael.wollner]  

I believe that data sheet is incorrect with respect to Smart licenses. I have just now submitted feedback to Cisco regarding that.

[Michael Wollner]

Thank you Marvin.

[Oliver Kaiser]

You are still required to buy a license for fmc, but it is not enforced anymore.

[ecgbello07]

I am setting up a pair of ASA 5555s for a customer that came with the FTD image. The customer requires multi-context so I had to reimage the Firewalls to use the ASA image. My concern is the licensing because I don't think the licenses that were purchased for the FTD image will work with the ASA. I am planning to open a TAC case but wanted to ask if there is any known way to migrate the licenses in a case like this or if the customer will need to buy new licenses.

[Marvin Rhoads]

There's no migration SKU or automatic entitlement.

The Cisco account manager may be able to arrange a one time entitlement in such a circumstance. It would be up to the business unit (in Cisco) to approve. 

[ecgbello07]

Thank you Marvin, I will follow up with the Cisco account manager

[JALALUDDEEN A A]

Hi all,

How to install anyconnect vpn license in Firepower 4120 for the ASA ?

i have the PAK for the ASA, but i don't know how to install in 4120.

Already enabled smart licensing,

Does it include anyconnect vpn license ?

How to install 5k user license in Firepower for ASA ?

[Marvin Rhoads]

If you have a PAK then it's a classic license. You need to convert it to a Smart License entitlement.

Once you do that, it should show up in your Smart License portal and you can apply it to the ASA logical device.

Note - you can only do that for unfulfilled PAKs.

If you have doubt on how to do it or if it applies in your particular case, the TAC can assist - ask for your request to be queued to the licensing team when you call and open a case.

[karthikeyankr16]

Hello Team, 

I have installed a Virtual Firepower Management Center and have FP 4110 with Smart license Included 1xFirepower Threat Defense Base Features + 1xFPR4110 Threat Defense Malware + 1xFPR Threat Defense Threat Protection. These 3 licenses are in USE. But I get the error - "Out oof compliance" for Firepower MCv Device License and it says 1 insufficient license. 

On the Virtual FMC smart license page it shows "Out of Compliance"

Please let us know how to proceed.

Regards,

Karthik

[Security_over_connectivity]

Anyconnect can now be converted to Smart licensing for FTD. Customer is on 6.3.0 and we were able to do the conversion in the account and assign it to the default smart account. This is something that can be done by the customer without TAC or Licensing intervention. 

[Marvin Rhoads]

@karthikeyankr16 Did you add the FMC license to your smart account?