Cisco WSA Licensing

[Vishnu Ravindranath]

Hi Team,

While purchasing Cisco WSA license we need to provide the number of users in the organization, so if we have 400 users can we go for 200 User license per proxy (if we are using both the proxy using WCCP) and how the proxy is calculating number of users at specific times.

What will be the impact if we have licensed 200 users and more users session start to flow through the proxy ?

Also can we use the same PAK key for both vWSA and WSA Appliance ?

Thank you,

Vishnu

[Ken Stieers]

No, you purchase a license for the total number of users in your company.

It you deploy one hardware box or multiple vms, you use the same license. If you want more than 1 hardware box, you purchase those separately, but you still only need the 400 seats. If your reseller can't figure that out, contact your Cisco rep.



How you actually get the license differs between hardware and software.

Generally they'll email you the keys for a hardware box when you purchase.



For VMs you go to the licensing site and request a license with a PAK. This is delivered as a license file, which you can apply to as many VMs of whatever size you need to service your 400 users/DR/HA, etc.



Some things to note:

If you ADD a feature (AMP for example), they'll send you a key for the hardware box, that just turns that one one.

For a VM you'll have to get a whole new file. Sometimes that means you have to open a ticket with the Global Licensing Operations team. (not really a big deal... they're good, and reasonably fast).

[Vishnu Ravindranath]

Thanks Ken,

So as i understand, we just need to purchase 400 users license and can install the same in two different Proxies.

And the PAK purchased for Hardware appliance wont be able to use in Virtual Appliance, both needs to be separately ordered and used,

Also could you please let know how the WSA is calculating number of user sessions (we have both Authenticated and No Authenticated user sessions). And what will be the impact if the total user count exceeds the licensed user sessions.

Thank you,

Vishnu

[Ken Stieers · Accepted solution]

Yes.



Technically the PAK for the hardware and the VM box ARE the same, and if things are working correctly with a fresh PAK you can go to the licensing site and request both at the same time.



Worst case is you get the hardware working and then go back to the GLO group and ask for a matching VM license, but I've been told the online options should work.



I'm pretty sure they're counting both authenticated and un-authenticated. If you go over, the box won't stop working or break.