Issue with modifying activation license on ASA

[jason.williams]

We have a few ASA 5540s that currently have a VPN Premium license installed on them.  We really don't need this license, plus we need to allow for more SSL VPN connections.

We purchased AnyConnect Essestials licenses with 2500 users.  I activated the auth codes and and got a new activation key.  The problem I'm having is that when I enter the new activation key, I get:

The requested key is the SAME as the flash activation key.
The requested key is the SAME as the running activation key.

When I run show activation-key, it shows the new key number as installed, but the features are the same and it still shows "This platform has an ASA 5540 VPN Premium license."

Any suggestions on what I can do to get the new license to take?

Thanks.

Jason

[Loren Kolnes]

Hi Jason,

Per the configuration guide AnyConnect essentials cannot be active at the same time as a VPN Premium license:

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/svc.html#wp1105255

Can you send the output of "sh activation-key | exc 0x|Number:"

Thanks,

Loren Kolnes

[jason.williams]

Here's the output:

Licensed features for this platform:
Maximum Physical Interfaces  : Unlimited
Maximum VLANs                : 200
Inside Hosts                 : Unlimited
Failover                     : Active/Active
VPN-DES                      : Enabled
VPN-3DES-AES                 : Enabled
Security Contexts            : 2
GTP/GPRS                     : Disabled
VPN Peers                    : 5000
WebVPN Peers                 : 500
AnyConnect for Mobile        : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
UC Proxy Sessions            : 2

This platform has an ASA 5540 VPN Premium license.

The flash activation key is the SAME as the running key.

I kind of assumed (obviously incorretly), that the new key would overwrite the old key.  Then how can I removed the VPN Premium license and start fresh?

Thanks.

Jason

[Loren Kolnes]

Hi Jason,

What version are you running on the ASA?

Thanks,

Loren

[jason.williams]

Sorry,

8.0.5

[Loren Kolnes]

Hi Jason,

AnyConnect Essentials is first supported in 8.2(1), which would explain why the activation key did not work.

Just to clarify the AnyConnect Essentials license is supported with the VPN Premium license but the Premium license is disabled when the anyconnect-essentials feature is enabled.

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/a2.html#wp1721336

Let me know if this answeres your question and if so please mark the post as answered.

Thanks,

Loren

[jason.williams]

That's interesting.  The email I received with the new activation key actually has 2 keys.

One states:

THE FOLLOWING ACTIVATION KEY IS VALID FOR:

ASA SOFTWARE RELEASE 8.2+ ONLY.

And the other:

THE FOLLOWING ACTIVATION KEY IS VALID FOR:

ALL ASA SOFTWARE RELEASES, BUT EXCLUDES ANY 8.2+ FEATURES FOR BACKWARDS COMPATIBILITY.

I assumed it would work with the older version of the software.

We have a DR ASA that's not currently in use.  I'll try upgrading that one first.  If all goes well with the license, I'll mark this as answered.

Thanks.

Jason