SSL VPN AnyConnect Client Licensing

[m.glosson]

We are looking at upgrading an old ASA 5510 to a 5525-X. Up till now we have stuck with the old IPSec client, but since that is not going to be supported for Windows 10 going forward, we are looking at finally moving to SSLVPN via the AnyConnect client. I remember a license called AnyConnect Essentials that you could buy on the older 5500 series (5510, 5520, etc) that would just allow SSLVPN AnyConnect client for all 250, 750, etc. That doesn't seem to be available anymore.

Licensing is a little complicated. I looked in someone else's 5525-X firewall who can't remember what they bought. It shows, concerning AnyConnect, the following 4 items:

AnyConnect Premium Peers          : 4              perpetual
AnyConnect Essentials             : 750            perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual

Do I need to get some special license to just use the SSLVPN AnyConnect client from desktop Windows?

[Marvin Rhoads]

The output you show looks like it came from an HA pair.

Each member has two AnyConnect Premium licenses (comes with all ASAs). So that's the 4 of those.

They also have purchased and installed AnyConnect Essentials. That was one license that covers as many as the hardware can handle - 750 in this case.  They did not purchase either of the last two license types.

Going forward with version 4.x and later, AnyConnect licensing is broken in Plus and Apex types. They are roughly equivalent to the old Essentials and Premium. Both include Mobile support so no more separate license for mobile devices. (Apex also includes the old Advanced Endpoint Assessment feature built-in.)

Licensing is terms based so no more indefinite (lifetime) term. (The exception is a perpetual license can be purchased for Plus but you still have to pay if you want support.)

Also, licensing is per unique user and not per active session. So one user with PC, tablet and smart phone active would require one license. That last bit is all "honor system" as there's no technical enforcement at this time.

So, for a new 5525-X you would just buy AnyConnect Plus with the number of users and length of term you want (1, 3 or 5 years).