RV-345 AnyConnect License

[msikora]

Hello,

We're looking for some information on Cisco licensing. After a bit of searching, I'm still not sure what the situation is.

Currently, we have an RV-320 and it is starting to have some issues. Periodically restarting the device seems to keep them at bay, but this is by no means a fix. With this device we are using OpenVPN to grant remote access to a few users. We have a replacement router (RV-345-K9 V02, v1.0.01.20) but, as far as I can tell, it doesn't support OpenVPN.

As stated, I have looked into licensing and am wondering if we can use a "Cisco AnyConnect Essentials VPN License [25 concurrent users]" (ASA-AC-E-5505) to allow 5 users or so to connect remotely. We don't need anything fancy. Just a secure connection to the server. I have read that there are other licenses we need but those are possibly related mobile.

Anyway, I would appreciate any insight into the matter. Thank you.

Matt

[Marvin Rhoads]

"AnyConnect Essentials" is the old discontinued license type. The current equivalent product would be Anyconnect Plus. It is available in 12-60 month term (or perpetual) license and will work with your new router.

Details can be found in the AnyConnect Ordering Guide (https://www.cisco.com/c/dam/en/us/products/collateral/security/anyconnect-og.pdf) or your reseller should be able to assist you.

[msikora]

Will the AnyConnect Plus subscription (L-AC-PLS-3Y-S1\L-AC-PLS-5Y-S1) work with the RV-320 as well? We would like to do some testing pre-transition. The RV-345 has two AnyConnectVPN session licenses for evaluation, does the RV-320 have this as well and will it work similar to AnyConnect Plus? This would be for testing as mentioned earlier.

Also, with the above licenses the User Range is 25-99. A footnote in the Ordering Guide seems to imply that we have to purchase 25 licenses, even if we only have 5 users. Is this the case? Or can the licenses be purchased one-off and activated?

Thanks for your help.

[Marvin Rhoads]

25 is the minimum purchase.

The licenses are per unique user and entitle you to use them on IOS devices like your RV345 router (no PAK required to be installed), ASA hardware (requires PAK installation) or ASAv and FTD devices (both require PAK to be converted to Smart license).

The older RV320 supports SSL VPN with Anyconnect client:

https://www.youtube.com/watch?v=X2muBFPw9cM

This guide shows how to do setup on the new RV345 router:

https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/smb5519-configure-secure-sockets-layer-virtual-private-network-ssl-v.html

In both cases you are given two non-expiring "trial" licenses on the router. Having more than 2 unique users requires purchasing the additional license.

[msikora]

So a single user license sold by a reseller is only valid for incremental purchases above 25 (eg. 26 or 27)? Or did the reseller buy in bulk and is distributing them separately?

Also, does the RV-320 (v1.4.2.19) support the AnyConnect license? I was unable to find an entry in the Configuration Utility.

[Marvin Rhoads]

I never heard of a single user AnyConnect license. I'd check if the reseller is legitimate if they claim to sell such a thing.

Your software version should support the SSL VPN feature. I'm not sure why it doesn't show up in your menus.

[msikora]

I have been looking on CDW. As far as I know they are reputable. It could just be that I misunderstood the pricing. For L-AC-PLS-3Y-S1 the bullets show as "1 user, volume, 25-99 licenses". I was able to add singular licenses to the cart but I suppose that doesn't mean that they will register on our router. Is that the case?

I suppose if that is the case, would the ASA-AC-E-5515= license work for the RV-345? Based on the bullets, it doesn't appear to be locked to a device but 5515 is an ASA device, no? The ASA-AC-E-5505 license specifically says, "for ASA 5505 Adaptive Security Appliance, 5505 Firewall Edition Bundle, 5505 VPN Edition". Does that mean it is locked to that device?

Then again, I suppose this is all moot, as the AnyConnect SMC says it is "available to customers with active AnyConnect Apex, Plus or VPN Only term/contracts." Does that mean this won't work? All we are trying to do is establish a VPN connection that can be used with RDP.

Thanks for your help Marvin. Hope you had/have an enjoyable New Year.

[Marvin Rhoads · Accepted solution]

Sometimes the online portals or 3rd party vendors reflect older SKUs (like the ASA-specific ones for "Essentials" (-E) which are technically discontinued by Cisco) and may also not reflect subtleties and complications in the licensing scheme Cisco uses.

The minimum AnyConnect license order is 25. Beyond 25 you can add users in increments of 1. You cannot purchase 1 only (or any number less than 25).

For 1-year term, 25 users list price is US$150 total. Additional users are US$6 each but they must be ordered as part of the 25-99 (or higher) band.

[msikora]

I think that has answered everything that I was looking for. Thank you very much.