AnyConnect for Cisco VPN Phone which Part Number to enable this?

[uwe.zillner]

Hello,

we need a License for our ASA5520

=> AnyConnect for Cisco VPN Phone

to test the new VPN Feature available for the IP Phones with UCM8

but we could not find any Part Number for this.

does someone have this Part Number? is it already orderable?

[vrostowsky]

all you need is one of the new Anyconnect license SKU's

the AnyConnect for Mobile also enables AnyConnect for Cisco VPN Phone

i purchased the anyconnect plus

3. Licenses AnyConnect 4.x offers simplified licensing to meet the needs of the broad enterprise IT community as it adapts to growing end-user mobility demands. AnyConnect 4.x collapses the formerly complex AnyConnect licensing model into two simple tiers. The first is AnyConnect Plus, which includes basic VPN services such as device and per-application VPN (including third-party IKEv2 remote access VPN headend support), trusted network detection, basic device context collection, and Federal Information Processing Standards (FIPS) compliance. AnyConnect Plus also includes other non-VPN services such as the AnyConnect Network Access Manager 802.1X supplicant, the Cloud Web Security module, and the Cisco Umbrella Roaming module. Existing AnyConnect customers should think of AnyConnect Plus as similar to the previous AnyConnect Essentials.

[Kalliopi Vazima]

In a ASA5510 I have the following output.

Due to CUCM upgrade to version 11 i have 20 remote ip phones that used to operate as UC proxy phones and now i need to make them operational again as AnyConnect for Cisco VPN phone.

The lisencing needed is annyconncect plus for 25 users, which is the minimum orderable?

Licensed features for this platform:

Maximum Physical Interfaces    : Unlimited

Maximum VLANs : 50       

Inside Hosts : Unlimited

Failover : Disabled

VPN-DES : Enabled  

VPN-3DES-AES : Enabled  

Security Contexts : 0        

GTP/GPRS : Disabled 

SSL VPN Peers : 10       

Total VPN Peers : 250      

Shared License : Disabled

AnyConnect for Mobile          : Enabled  

AnyConnect for Cisco VPN Phone : Disabled 

AnyConnect Essentials          : Enabled  

Advanced Endpoint Assessment   : Disabled 

UC Phone Proxy Sessions        : 50       

Total UC Proxy Sessions        : 50       

Botnet Traffic Filter          : Disabled 

[vrostowsky]

the UC proxy license minimum is 24, it is not the Anyconnect plus or apex feature

The following applications use TLS proxy sessions for their connections. Each TLS proxy session used by these applications (and only these applications)

is counted against the UC license limit:

- Phone Proxy

- Presence Federation Proxy

- Encrypted Voice Inspection

ASA-UC-24-50= ASA 5500 UC Proxy 24 to 50 upgrade sessions CON-SNT-ASAUP50

[Kalliopi Vazima]

Thanks for the answer but the point is that i can no loger use the phone proxy feature due to CUCM upgrade, so i read that Annyconect Plus lisence should be OK. The question is if this licensing is correct in order AnyConnect for Cisco VPN Phone to be enabled?

[vrostowsky]

i purchased the anyconnect plus licensing and yes it did enable the Cisco VPN Phone feature as you can see in my top screenshot off my ASA.  and yes, the minimum for anyconnect licensing is 25.

[Kalliopi Vazima]

Thanks again for the answer. Did you disable essential licenses as well?

[vrostowsky]

there is no need, it no longer exists in their portfolio, just Plus and Apex.  once you apply the license it will show disabled.

hope this helps-

[Kalliopi Vazima]

so the other features, like VPN connections, apart from IP PHONES keep operating normally?

[vrostowsky]

well.....if you have not purchased migration licenses for the old anyconnect (like essentials) then you will need to make sure you purchase enough licensing to cover both your UC needs as well as your RA VPN needs.  The licenses are based on "1 license for each unique user"  IF you have site to site VPN, then that keeps working as it is based off the ASA model hardware.  you will also be able to use the Anyconnect client on smartphones with the plus licensing.

[Kalliopi Vazima]

Hello again,

at customer's site a demo license has been enabled and the sh ver is listed below

Licensed features for this platform:

Maximum Physical Interfaces    : Unlimited

Maximum VLANs : 50       

Inside Hosts : Unlimited

Failover : Disabled

VPN-DES : Enabled  

VPN-3DES-AES : Enabled  

Security Contexts : 0        

GTP/GPRS : Disabled 

SSL VPN Peers : 10       

Total VPN Peers : 250      

Shared License : Disabled

AnyConnect for Mobile          : Enabled  

AnyConnect for Cisco VPN Phone : Enabled  

AnyConnect Essentials          : Enabled  

Advanced Endpoint Assessment   : Disabled 

UC Phone Proxy Sessions        : 50       

Total UC Proxy Sessions        : 50       

Botnet Traffic Filter          : Disabled 

have you any idea why the AnyConnect Essentials are not disabled?

[vrostowsky]

what version of code are you running on the ASA 5510?

[Kalliopi Vazima]

8.2(5)33

[vrostowsky]

That may be why you see features differently.  I am running 9.x and i do not even have the SSL VPN peers in my sh ver.   I would try testing your Cisco VPN Phone functionality with that eval license to ensure it resolves your issue. 

The licensing model changed in 9x to a shared license when using failover. 

[vrostowsky]

To order a Cisco AnyConnect Plus or Apex subscription license on CCW, start by first choosing the service tier and length of term (L-AC-PLS-xYR-G or L-AC-APX-xYR-G with “x” being 5, 3 or 1). To order a Cisco AnyConnect Plus perpetual license, start by first choosing L-AC-PLS-P-G. Next choose “Select Options” and select the count based license option(s) based on the total number of possible unique users that will use that tier of Cisco AnyConnect service. For example, AC-PLS-5YR-1500-S, AC-APX-3YR-10K-S, or AC-PLS-P-100-S. For the term-based licenses, the pricing will populate after selecting the user count. After selecting your user count(s), a high quantity expansion SKU in the format of L-AC-yyy-S-xY-zzzz is added at no cost. This SKU enables a multi-use Product Activation Key (PAK), which can be used to enable ASA VPN services throughout the enterprise. For term based licenses, a SKU in the format AC-PLS-xYR-zzzz/AC-APX-xYR-zzzz is automatically added to entitle SASU (software and support services) and will contain the pricing for your selected term.

[mibrahim1986]

Thank you very much guys!

Cheers
Mohamed