FireSIGHT Management Virtual Machine download

[Keith Pemberton]

Recently purchased an ASA 5512-x with FirePOWER services.  I am having trouble downloading the FireSIGHT management virtual machine because it says that I need additional licensing requirements to do so.  I have tried registering the Control License PAK that I received, but it asks for the License Key for the FireSIGHT Source Defense console, which I cannot download because I don't have licensing rights to that.  Feel like I am in a catch-22 situation.  Any suggestions?  Already filed a ticket with Cisco support who keeps insisting that I give them the Model_No + MAC_ID from the source defense console.  Thanks in advance for any suggestions.

[mereyes]

Keith,

My team will review your situation and provide feedback by today.

Thanks,

Merv Reyes

[dhvenkat]

Keith,

As mentioned in the email for the case, we need you to buy the Virtual FireSight SW for VMWARE "FS-VMW-SW-K9" PID. This will help you to download the SW for Virtual FireSight, you can install the SW and then you will be able to find the license-key of the defense center. 

All license like "ASA5515-CTRL-LIC" goes to the defense center (Virtual FireSight), you will need the license-key to register the PAK and get the license.

Hope this helps.

- DD

[Keith Pemberton]

As mentioned above, my organization did purchase this license through our usual reseller but because of the complicated ordering process the order was associated with my reseller's cisco ids.  If I am purchasing a cisco product or service through a reseller, who is responsible for making sure that this product or service is associated with my company and cisco id?  Is there an easier way to do this besides having to call the TAC to get my id associated with the service contract number? 

[Marvin Rhoads]

As noted you need to purchase the Firesight Management Center (FMC). All FirePOWER appliances (physical, virtual or ASA module-based) need an FMC to manage them and their licenses.

If you have your sales order number that included the FMC, the TAC can associate your cisco.com userid with that and you should then have rights to download the software.

Your partner's sales engineers should also be able to help you with this.

[shovelhd]

We have precisely the same issue. It is not clear how we are to obtain either the FireSight software or the Sourcefire licenses for our new pair of ASA 5525s. Both PAKs insist we need license key from defense center but we are blocked from downloading this because "Additional entitlement is required"  Our partner insists we have everything need but neither partner nor Cisco Global Licensing will walk us through the process. Global Licensing insist that they only provide licenses and that we need to contact TAC if we need a licenses. Quite a frustrating process - typically, if we have PAKs, we have what we need but this is not the case here.The SourceFire web site was even less helpful.

As a veteran of the MARS debacle, this seems all too familiar... I'm hoping the similarity is purely coincidental.

[Marvin Rhoads]

It sounds like your cisco.com userid is not associated with the Smartnet service contract that includes the Firesight Management Center. Your bill of materials should have included items something like the following:

FS-VMW-2-SW-K9 Cisco FireSIGHT Management Center (VMWare) for 2 devices

CON-SAU-VMWSW2 SW APP SUPP + UPGR Cisco FireSIGHT Mana

The first line is the software itself (for the 2 device license) and the second is the support contract number.

You should also have a Sales Order (SO) number. If you call the TAC and cite that SO number and request they associate your cisco.com userid with the contract number included in that SO, they should be able to help you.

I would also hold your reseller accountable for this - they should be able to get you the software themselves even if you didn't buy Smartnet. I certainly would for one of my customers. They should be providing your the PAKs for the FMC and devices licenses in addition to the software itself.

[Keith Pemberton]

Yeah, this is the problem with having to go through a reseller in order to purchase these services.  Most often the support contracts get associated with the email address of the reseller person that actually purchases the licenses through a warehouse, such as Ingram Micro, etc.  I find it really ridiculous that Cisco pretty much makes the end user call the TAC to setup a support ticket to get their own Cisco user ID associated with the support contract so that software can be downloaded (a process that can take about a week to get done).  I would imagine that most of the time the Cisco reseller is not actually installing the software for the end user (thankfully that was not the case for us).  Hope that Cisco is listening to this feedback; they sure know how to make the purchase process hard to deal with.   

[Marvin Rhoads]

Sorry the process has been so frustrating for you. I am sometimes frustrated by the system's complexity and I've been a Cisco customer for 20 years and with partners for the past 3-1/2.

With the SO number in hand the TAC first line call center can make the service contract association happen for you in near real time. I've had it done for myself many times.

I agree the reseller can (and should) take care of that for you. The more experienced ones will.

Actually with all the FMC orders I've seen come through our office since the software was released last September, we have installed more than half of them for our customers.

[shovelhd]

Marvin,

First, thank you so much for taking the time to try to help us resolve our  issues.  We are still waiting on a response from TAC. 

You said:

"It sounds like your cisco.com userid is not associated with the Smartnet service contract that includes the Firesight Management Center. "

Yes! We think you are correct about this and we are moving to resolve. Reseller has stated it IS resolved but alas, we don't think so... but we are not exactly sure where to look on the "new and improved" Cisco Licensing Portal. 

You said we should have these license PAKs

FS-VMW-2-SW-K9           Cisco FireSIGHT Management Center (VMWare) for 2 devices
CON-SAU-VMWSW2           SW APP SUPP + UPGR Cisco FireSIGHT Mana

Our invoice from reseller reads:

FS-VMW-2-SW-K9           Cisco FireSIGHT Management Center,(VMWare) for 2 devices        
CON-SAU-VMWSW2           3 YR SW APP SUPP + UPGR Cisco FireSIGHT Mana                    
L-ASA5525-TAMC-3PR       Cisco ASA5525 FirePOWER IPS, AMP and URL 3 YR Subs Promotion    

We have recieved 2 PAKs:

FS-VMW-2-SW-K9       Cisco FireSIGHT Management Center,(VMWare) for 2 devices     1
L-ASA5525-TAMC-PR=   Cisco ASA5525 FirePOWER IPS, AMP and URL Licenses Promotion  1

In addition, we have purchased the following options:

CON-SNT-A25FPK9     3 YR SMARTNET 8x5xNBD ASA5525x with Firepower Services, 8G
ASA5525-FPWR-K9     ASA5525-X with FirePOWER Services, 8GE, AC, 3DES/AES, SSD
ASA-AC-E-5525       AnyConnect Essentials VPN License - ASA 5525-x (750 Users)
ASA-AC-M-5525       AnyConnect Mobile - ASA 5525-x 
 

So....., as far as we can tell, this is all correct and we should have everything we  need.  But the reseller, whom we are trying out for the first time, has not exactly been responsive to our inquiries about this and is not winning any points from my manager. 

When we attempt to enter either of our 2 PAKs, we are still directed to enter a License Key from SourceFire Defense Center which we cannot download because "Additional Enntitlement is Required".  

I feel like I'm stuck in theat old Abott and Costello skit "Who's On First?"  ;)

[Marvin Rhoads]

You're welcome.

The PAK for "FS-VMW-2-SW-K9" would ask for you for the Sourcefire Defense Center (old name for FireSIGHT Management Center or FMC) as would the TAMC one for the device license. That's because PAK redemption will issue a license file that is tied to the FMC license key.

Download and installation of FMC does not require a PAK though. It requires contract association for your cisco.com userid.

You an get the TAC first level phone support to do that by citing your Sales Order (SO) number. Just tell them that when they ask for your serial number. I use the phrase " I need to associate my userid and I have the SO number." As a partner, I do that several times a year and it's always worked for me. I've also had my customers follow the same method.

[TechDude]

I ran into the same, call in and ask for them to publish a download for you, I ended up with 5.4 which at the time wasn't available for download through the gui.

Roughly a month later I can now download the vDC with my CCO login, but 20 minutes on the phone and I had it.

MAC_ID, you get this after you install the vDC available under the licenses section.