Is this FMC virtual Strong Encryption 3DES/AES license (L-FMCVIR-ENC-K9) included at zero cost? for Cisco 1120 NGFW Appliance. How to install and enable this encryption?

I would like to allow only 1 public ip to have remote access vpn to a PIX 506E,already remove sysopt connection permit-ipsec. apply access-list on the outside interface, VPN tunnel still can be establish even if I, apply acl with deny ip any any. Can...