CSC-SSM problem

[aadilovic]

Hello,

>

> i got this message:

>

> [InterScan for CSC SSM Notification] License Violation

>

> License violation has been detected on the InterScan for CSC SSM. There

> are currently 101 active nodes while you only have 100 seats of license. 1

> more seats of license is required.

> Please upgrade your license to resolve the violation.

>

> I get this every night at 01:00 am. I don't have 100 PC in my network.

> What could it be? And why always at 01:00 am?

>

> Best regards

[ccbootcamp]

The key thing is "nodes" not PCs. You can click the Content Security tab in the Cisco Adaptive Security Device Manager to open the CSC SSM Information box. The Licensed Nodes number represents the number of users.

The CSC-SSM should be licensed for the total, not concurrent, number of users whose traffic is being scanned (ie number of PCs is irrelevant).

-brad

http://www.ccbootcamp.com

(please rate the post if this helps!)

[philip.neeson]

Hi,

How does the CSC-SSM determine the number of "Nodes" or users and how can the current user count be seen from the CLI/ASDM? Is this IP address based?

If its not based on concurrent users, then how does the device cater for roaming or mobile users?

If Bob comes to head office for 1 day, will the CSC-SSM count him as 1 user, can you release his slot or will it release after a period of time?

Philip.

[vikasgupta2k]

Did you find any answer for your question, I'm also running into same issue and not sure what happens to the extra users which exceed the license limit.

Thanks

[jyothydas]

Is there a way to find out the number of active nodes on CLI or GUI?

I need to know this so that I can find from which ASA I get this message.

[fleming-j]

This issue has confused us for a while too… Here’s the deal:

Even after the license violation the traffic for all the users will be scanned by the module. Despite the error message that you are seeing, the CSC will not drop connections due strictly to license violations.  It is only a warning at this point. 

With a high number of nodes, it is likely that you will overwhelm the CSC processing capacity.  If the users are overly aggressive in their connections, they can easily max out the capacity.

Here's a high level link:

http://www.cisco.com/en/US/customer/products/ps6120/products_white_paper0900aecd805c3cd6.shtml

Can you increase the license?  It only goes up to 1,000.

How can you tell what the count is?  Use the following command from the ASA CLI:

show csc node-count yesterday

Here's the link:

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s2_72.html#wp1186101

Hope this helps!