AnyConnect Licensing - Plus/Apex or Essentials?

[stownsend]

I'm trying to Figure out if I go Old School Licensing or New, Having a Hard time getting the Right info from my Vendor. Tell me what I get for the 5 Year Subscription that I need to renew in 5 Years that I won’t get with the AnyConnect For Mobile ( L-ASA-AC-M-5525) and the AnyConnect Essentials L-ASA-AC-E-5525?
 
Both L-ASA-AC-M-5525 and L-ASA-AC-E-5525 are available till the end of August for $300 (for both) and its a Perpetual License
 

We don't use anything fancy for AnyConnect. Just having Laptops, iPhones and iPad Connect to Corp Office. 

For the Plus License, its user Based, i.e. 100 Users, Are they Concurrent users or Named Users?  If Named Users how are the named users Managed?  From the AnyConnect Licensing PDF http://www.cisco.com/c/dam/en/us/products/security/anyconnect-og.pdf, 
“The number of licenses needed is based on all the possible unique users that may use any Cisco AnyConnect service. The exact number of Plus or Apex licenses should be based on the total number of unique users that require the specific services associated with each license type.”

What is a Unique User?  I have 3 iPads, a few Macbooks, a few PC Laptops and an iPhone, more than 8 Devices I can login from. Am I a Single User or 8?

We Currently use MS Active Directory to do the Authentication of the AnyConnect Clients. I don’t want to have to install yet another Identity Management and Password Manager To Manage the Unique Users.

Thank you,

   Scott<-

[Karsten Iwen · Accepted solution]

> We don't use anything fancy for AnyConnect. Just having Laptops, iPhones and iPad Connect to Corp Office. 

Well, in the future, the fancy thing could be just to use it. I don't expect that AC 3.x get's much more development. Who knows if the with the next changes in Windows10 AC3 will still work?

> For the Plus License, its user Based, i.e. 100 Users, Are they Concurrent users or Named Users?

They are named users, so with your next example, you need one license with your eight devices.

The licensing is done on a trust-basis. Nothing to install to control the licenses. At least not for the moment. I expect that in a couple of years there will be some kind of enforcement for the licensed userbase.

I decided for all new deployments to go for AC4 for mainly two reasons:
1) As the Plus-license is quite cheap it typically doesn't cost more then Essentials and Mobile for the first five years. (That's for my deployments, your calculation may vary).
2) It's possible to mix Plus and APEX licenses. Now it is possible to have a couple of hundred AnyConnect users and still give a small amoount of users the possibility to use clientless without having to pay premium for all.

[stownsend]

Thank you for your reply. It makes sense to go with the Plus in terms of Cost. Will Probably replace the ASA5525 in 10 years anyway, so it would even out for the 100 users. 

How are the named users maintained?  the first 100 Users that Login have a License? Do I have to Enter Valid users somewhere? What if a Employee Leaves, I can disable the Active Directory Account, how do I reclaim the License?

Thanks again!

[Marvin Rhoads · Accepted solution]

There's no technical or enforced linkage to the unique named end users at all (at this time).

Usernames and their associated accounts (no matter what authentication server is used - the ASA, AD, RSA, etc.) are strictly your "honor" that the licensed count isn't being exceeded.

[stownsend]

Great! Thank you!