FTD PAYG licensing in AWS to enable AES256 Encryption

[smithy-au]

I'm trying to test a FTD in AWS. I'm using the PAYG AMI (ami-04d7dfdc0d700e259). I assumed it would include the required licensing as it a PAYG. Fortinet, PAN, F5 etc include the licensing with their PAYG AMIs.

When I try to add a new IKEv2 policy using AES256, I get the following error: "Usable cryptography types are currently restricted by the licensing status of the device"

How do I enable the full license for the PAYG instance? I need to test an IPSec scenario and only need the device for a few days. It's currently using an Evaluation license - how do I make it use the hourly PAYG license from AWS?

[ahollifield]

You need to register the device to your Smart Account.

[smithy-au]

But I don't have one. I would have thought the PAYG would cover the license and the compute.

So I need to register for a Smart Account for testing a PAYG instance?

I'm using Terraform to build and automate - can the Smart License also be automated?

[ahollifield · Accepted solution]

No. But it's not about the license. It's about the export control features. Cisco must make sure you are a company who is able to and located in a geography that is allowed to use advanced encryption algorithms.

[smithy-au]

This is hopeless. I guess I'll stick with my Forti.

[Aref Alsouqi · Accepted solution]

Just to add to what @ahollifield mentioned, the actual licenses will be included in the PAYG subscription, for instance malware, URL filtering, etc will be included without having to buy any smart licenses. However, you still need a smart account to be activate it before you can register the device and it's actually a prerequisite as you can see in the link below:

Cisco Secure Firewall Threat Defense Virtual Getting Started Guide, Version 7.2 and Earlier - Deploy the Threat Defense Virtual on AWS [Cisco Secure Firewall Threat Defense Virtual] - Cisco