Questions about ASA5505 Licensing

[pedro juan roig roig]

Hi,

I have been looking into the ASA 5505 Hardware-Bundles and I have learnt that there are the following:

- The Basic License, offering just 3 VLANs (the 3rd one restricted). It also offers just 2 SSL VPN AnyConnect Premium Licenses and 10 IPSec VPN (which comprises old Cisco VPN Client and EasyConnect), accounting both up to 10 VPNs.  There are 3 types of Bundles, whose part numbers are:

  ** ASA5505-BUN-K9   --> which is the basic Bundle, offering up to just 10 internal concurrent users

  ** ASA5505-50-BUN-K9  --> offering up to 50 internal concurrent users 

  ** ASA5505-UL-BUN-K9  --> offering unlimited internal concurrent users

- The Security Plus License, offering up to 20 VLANs and unlimited internal concurrent users (regarding the Hardware-Bundle edition). It also offers just 2 SSL VPN AnyConnect Premium Licenses and 25 IPSec VPN (which comprises old Cisco VPN Client and EasyConnect), accounting both up to 25 VPNs. There is just one type of Bundle, whose part number is:

   ** ASA5505-SEC-BUN-K9  --> offering unlimited internal concurrent users.

 If you have the basic ASA5505-BUN-K9 Basic License and you want to upgrade to Security Plus License, you would activate 2 licenses:

    + the Security Plus License --> ASA5505-SEC-PL=  (or the L-ASA5505-SEC-PL= if you want to receive it via email)

    + the Unlimited Users License --> ASA5505-SW-10-UL  (as if the Security Plus License is not Hardware-Bundle, it does not come with unlimited users)

and that's why it is much better to purchase the Security Plus License Hardware-Bundle right from the bat than upgrading later.

This is as much as I could get, but I still have a couple of questions that I would like you to help me solve:

QUESTION 1.- Is the above information right or is there anything wrong?

QUESTION 2.- I have heard there is an AnyConnect Essentials VPN License offering up to 25 AnyConnect Essential Licenses concurrently, and I would like to know what is the difference between those licenses and AnyConnect Premium VPN Licenses?  Will I be able to connect with an AnyConnect Essentials License through RDP?

QUESTION 3.- I have also heard there is another bundle called ASA5505-SSL10-K9 offering up to 10 SSL VPN AnyConnect Licenses, which has been deprecated just recently. Was Security Plus License with unlimited users included in this Hardware-Bundle?

QUESTION 4.- Alternatively, there is another license called ASA-SSL-10, which could be installed along with Security Plus License. Does it work the same way the the above Hardware-Bundle?

QUESTION 5.- When reaching the limit of internal concurrent users permited, how long would it take to refresh the counter since a user gets out of the internal network?

Kind Regards,

PEDRO

[Karsten Iwen]

Yes, it's really that easy!

[pedro juan roig roig]

Hi Karsten,

I remember you said AnyConnect Plus Licenses apply for AnyConnect 4, which I have it implemented in Windows machines, but I have AnyConnect 3.1.01587 for OS X machines.

Therefore, will I be able to use AnyConnect Plus Licenses with AnyConnect 3.1?

[Karsten Iwen]

With the AnyConnect 4 license you still can use the AC 3.x client. But AC4 is also available for MacOS, you can upgrade to AC4.

[pedro juan roig roig]

Hi Karsten,

Just with a quick search I have learnt there is the new AnyConnect 4 version for OSX:   Cisco AnyConnect Secure Mobility 4.1.02011

I will upgrade it and go for the AnyConnect Plus License.

Thanks very much for your help!

[pedro juan roig roig]

Hi Karsten,

I just came across another doubt: Is there any difference between

L-ASA5505-10-50 and ASA5505-SW-10-50 ?

I assume the first one being email delivered, but what does the -SW- mean?

[pedro juan roig roig]

Hi Karsten,

I will try to answer myself:

Is  L-ASA5505-10-50  an eDelivery SKU   

and  ASA5505-SW-10-50  a Physical SKU?

So the only difference is the way they are sent to the customer?

[pedro juan roig roig]

Hi Karsten,

Just another question: regarding clientless SSL VPNs:

- if you have a Basic License, allowing just 2 SSL VPN peers, are they unlimited by default, or the 2 SSL VPN peers limit applies to both, client-based and clientless?

- if both client-based and clientless share the SSL VPN limit, when upgrading the AnyConnect Plus License for 25 users, does it also apply for clientless connections or is there any special license to enlarge the number of clientless SSL VPN connections?

[Karsten Iwen]

> Is  L-ASA5505-10-50  an eDelivery SKU   
> and  ASA5505-SW-10-50  a Physical SKU?

yes, that's right.

> - if you have a Basic License, allowing just 2 SSL VPN peers, are they unlimited by default, or the 2 SSL VPN peers limit applies to both, client-based and clientless?

Both AnyConnect and clientless is limited.

> - if both client-based and clientless share the SSL VPN limit, when upgrading the AnyConnect Plus License for 25 users, does it also apply for clientless connections or is there any special license to enlarge the number of clientless SSL VPN connections?

The Plus license is not for clientless. If you need AnyConnect and also clientless, you need to buy the APEX license.

[pedro juan roig roig]

Hi Karsten,

As per the 2 SSL VPN peers allowed by default in a Basic License, I supposed this number comes from adding up client-based and clientless connections.

I mean, you could have up to 2 AnyConnect sessions, or 2 https sessions or 1 of each type, but not having more than 2 connections adding up both kinds. Is that the case?

[Karsten Iwen]

> Is that the case?

Yes, 2 is the limit for AnyConnect and clientless combined.

[pedro juan roig roig]

Hi Karsten,

That's what I wanted to confirm. Thanks very much.

And regarding the new Plus Licenses, I guess they are ready to be inserted into the ASA5505 hardware-bundle, right? I am telling you this because I get in touch with a seller and I was told they were not aware of L-AC-PLS-5YR-G   and  AC-PLS-5YR-25-S  licenses but they did about L-ASA-AC-E-5505=  

If I used L-ASA-AC-E-5505= in order to get 25 SSL VPN users, do you think it would make any difference instead of using L-AC-PLS-5YR-G   and  AC-PLS-5YR-25-S ?

[Karsten Iwen]

AnyConnect Essentials is announced EOS, you shouldn't buy them any more!

[pedro juan roig roig]

Hi Karsten,

I see L-AC-PLS-5YR-G   and  AC-PLS-5YR-25-S  licenses are the good ones in order to get 25 AnyConnect users. And I must ask for both to the seller, right?

[pedro juan roig roig]

Hi Karsten,

Thanks very much for your help. Now I feel ready to order those licenses.

Kind Regards,

PEDRO