Question on Anyconnect Licensing costs

[walterg74]

Hi everyone, I know this is probably a dumb question, but our legal department came to ask the cost of the Anyconnect Client  (we're using the full client version).

On one hand, you need a service agreement to actually download the client, but on the other, as far as I know you actually license the device for a certain number of users/connections, don't you?

So is there an actual cost for the client itself, or is it simply the cost of whatever license you get for the ASA (25, 50, 5000! etc) and that's it?

To put it in a different way... Let's say I have a 250 user license on the ASA, which would mean I can have a maximum of 250 users connected at one time. Would it also mean I could legaly only hace 250 copies of the anyconnect client installed on client computers, or could I perfectly on the other hand have the client installed on (going absurd here) 10.000 computers for all I cared, but I could only connect 250 of them at the same time?

Sorry if it's too dumb/simple but I can't find info for licensing in that regard anywhere, and all links just point to the licensing on the ASA itself.

Thanks!

[Collin Clark]

Hi Walter,

The client itself is free, you just pay for the number of simultaneous connections.

Hope it helps.

[walterg74]

Yes, that's what I thought too, it's just that it's difficult to explain to these people, as since they see the "you need a service agreement to download" they infer it's not free...

[hobbe]

Actually I think you can formulate it just as you do the normal ipsec client wich you state you already have.

Or if you want, like this.

The vpn solution consists of two parts, The vpn client and the vpn server.

The vpn server needs to have a license to enable different functionalities for what type of client is to be used.

The different licenses costs a one time fee to enable.

The client is shipped with the firewall at the time of purchase.

if you do not want to upgrade (download from cisco) the client then no fee is applicable.

if you do want to upgrade (download from cisco) the software from cisco to the newest version you will have to use a CCO account that have the rights to download the software.

One way to achieve a CCO account with the ability to download the software would be to buy a smartnet for the firewall (VPN Server).

In the license agreement if i am not misremembering it states that the client is free to be used with any Cisco vpn device. ie you are not allowed to use it with fx checkpoint firewalls.

even if you are able to make it work (wich i doubt it will).

This means that the use of the client us free but IF you need to be able to get a hold of bugfixed versions you will have to have a account.

ie client free to use.

if they ask anymore then just show them the EULA and let them themselves figure it out.

Good luck

HTH

[walterg74]

Hi hobbe,

thanks for the answer, but I did not state we use the ipsec client (which we don't).

Regards.

[hobbe]

My mistake, I somehow misread full client version for ipsec client version.

Regards

[MCCC.Administrator]

I just went through this with my ASA5510 and thought I would pass it along.

I read the licensing and understood that using AnyConnect with SSL I would need to purchase licensing to use it that way, but since I was using ipsec I thought I was OK.  Not so.  My configs worked great until the 3rd person tried to connect and then it would fail.  Turns out that the ASA comes with 2 "free" AnyConnect licenses.  Even if you are running AnyConnect under the IPsec configuration you need to buy an additional license.

The cost?  A very small $85 (for govt, maybe a little more for retail).

That was for the entire 250 connections, not each.

This enabled me to have 250 concurrent AnyConnect Essential connections.

For something that costs this little you would think that they could roll the $85 into the cost of the ASA.

Had I wanted to use AnyConnect configured with SSL then I was told I would need to buy a license for every concurrent user.  That would have been about $16K.

And you can't mix them up.  If the AnyConnect Essentials is enabled, you can't have the AnyConnect SSL's enabled.

Quite confusing.