05-29-2014 12:39 PM
we have two ASA 5525-X and we know its coming with 2 VPN Premium license as default, however we configured both firewalls as Active/Standby failover.
my question is, we should have 4 VPN Premium license ?!!! as we known its merge all VPN Premium license ?!!
Please advise?
Regards,
Eng. Boody
05-29-2014 04:09 PM
I believe you should see 2 for the platform and 4 total for the HA cluster.
Assuming you have the failover pair configured and working, please share the output of:
sh ver | i Premium
05-30-2014 02:37 AM
ASA# sh ver | i Premium
AnyConnect Premium Peers : 2 perpetual
This platform has an ASA5525 VPN Premium license.
AnyConnect Premium Peers : 4 perpetual
This platform has an ASA5525 VPN Premium license.
***********************************
ASA# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: Failover_Int GigabitEthernet0/6 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 4 of 216 maximum
Version: Ours 9.1(1), Mate 9.1(1)
Last Failover at: 13:14:02 AST May 26 2014
This host: Primary - Active
Active time: 294357 (sec)
slot 0: ASA5525 hw/sw rev (1.0/9.1(1)) status (Up Sys)
Interface Outside (x.x.x.x): Normal (Not-Monitored)
Interface Inside (10.10.10.1): Normal (Monitored)
Interface DMZ (11.11.11.1): Normal (Monitored)
Interface Manag (100.100.100.101): Normal (Monitored)
slot 1: CXSC5525 hw/sw rev (N/A/9.1.1) status (Up/Up)
ASA CX, 9.1.1, Up
Other host: Secondary - Standby Ready
Active time: 0 (sec)
slot 0: ASA5525 hw/sw rev (1.0/9.1(1)) status (Up Sys)
Interface Outside (0.0.0.0): Normal (Not-Monitored)
Interface Inside (10.10.10.2): Normal (Monitored)
Interface DMZ (11.11.11.2): Normal (Monitored)
Interface Manag (100.100.100.102): Normal (Monitored)
Interface management (0.0.0.0): Normal (Not-Monitored)
slot 1: CXSC5525 hw/sw rev (N/A/9.1.1) status (Up/Up)
ASA CX, 9.1.1, Up
ASA# sh failover state
State Last Failure Reason Date/Time
This host - Primary
Active None
Other host - Secondary
Standby Ready Comm Failure 13:14:17 AST May 26 2014
====Configuration State===
Sync Done
====Communication State===
Mac set
***************************
ASA# sh ver
Cisco Adaptive Security Appliance Software Version 9.1(1)
Device Manager Version 6.6(1)
Compiled on Wed 28-Nov-12 11:15 PST by builders
System image file is "disk0:/asa911-smp-k8.bin"
Config file at boot was "startup-config"
ASA up 35 days 19 hours
failover cluster up 35 days 19 hours
Hardware: ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)
ASA: 4096 MB RAM, 1 CPU (1 core)
Internal ATA Compact Flash, 8192MB
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB
Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)
Boot microcode : CNPx-MC-BOOT-2.00
SSL/IKE microcode : CNPx-MC-SSL-PLUS-T020
IPSec microcode : CNPx-MC-IPSEC-MAIN-0022
Number of accelerators: 1
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4
0: Int: Internal-Data0/0 : address is 7428.ac5a.d7d9, irq 11
1: Ext: GigabitEthernet0/0 : address is 7428.ac5a.d7de, irq 5
2: Ext: GigabitEthernet0/1 : address is 7428.ac5a.d7da, irq 5
3: Ext: GigabitEthernet0/2 : address is 7428.ac5a.d7df, irq 10
4: Ext: GigabitEthernet0/3 : address is 7428.ac5a.d7db, irq 10
5: Ext: GigabitEthernet0/4 : address is 7428.ac5a.d7e0, irq 5
6: Ext: GigabitEthernet0/5 : address is 7428.ac5a.d7dc, irq 5
7: Ext: GigabitEthernet0/6 : address is 7428.ac5a.d7e1, irq 10
8: Ext: GigabitEthernet0/7 : address is 7428.ac5a.d7dd, irq 10
9: Int: Internal-Data0/1 : address is 0000.0001.0002, irq 0
10: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 0
11: Int: Internal-Data0/2 : address is 0000.0001.0003, irq 0
12: Ext: Management0/0 : address is 7428.ac5a.d7d9, irq 0
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 200 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 750 perpetual
Total VPN Peers : 750 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
IPS Module : Disabled perpetual
Cluster : Disabled perpetual
This platform has an ASA5525 VPN Premium license.
Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 200 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 4 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 750 perpetual
Total VPN Peers : 750 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 4 perpetual
Total UC Proxy Sessions : 4 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
IPS Module : Disabled perpetual
Cluster : Disabled perpetual
This platform has an ASA5525 VPN Premium license.
Configuration register is 0x1
05-30-2014 05:59 AM
So it's working as designed - 2 licenses on each platform and 4 total for the 2-unit HA pair.
Does that answer your question?
05-31-2014 01:16 AM
No, my problem is we can work with two users only concurrent and when we tried to use third or fourth user its give us login failed and once we log out from previous users we able to log in with third and fourth users ?!!!
its meaning its still using the 2 licenses
we think it may work in scenario Active/Active only not with Active/Standby!!!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide