Category:Cisco Systems -> Security
I won’t broadcast any news here. I’ll just quote information about licensing that I found from Kevin Breit’s web article here http://packetpushers.net/cisco-asa-licensing-explained/
Security Plus
Security Plus licensing exists only on 5505 and 5510. On the 5505 it has the following effects:
- Upgrades the maximum VPN sessions from 10 to 25.
- Upgrades the maximum connections from 10,000 to 25,000.
- Increases the number of VLANs from 3 to 20 and enables trunking.
- Enables optional stateless active/standby failover.
On the 5510 it has slightly different set of features it enables:
- Upgrades the maximum connections from 50,000 to 130,000.
- Moves 2 of the 5 FastEthernet ports to 10/100/1000.
- Increases the number of VLANs from 50 to 100.
- Enables security contexts and allows for 2. Up to 5 can be supported on the 5510.
- Enables optional active/active and active/standby failover.
- Enables VPN clustering and load balancing.
The 5520 and up do not have Security Plus licensing. They come with the Base license and need nothing more to get the most performance out of the unit. Only 5585X series does have Security Plus licenses which enables the 10GB SFP+ slots.
5505 User Licenses
The 5505 is the only ASA which has a restriction on the number of “users” behind a firewall. A user is considered an internal device which communicates with the external VLAN. By default the 5505 ships with a 10 user license but can be upgraded to 50 or unlimited users.
SSL licenses break into two general types: Essentials and Premium. Essentials license provides AnyConnect client based connections from personal computers including Windows and Mac systems. Installing an Essentials license allows for up to the maximum number of VPN sessions on the platform to be concurrently used for SSL. For example, a 5510 would immediately allow for up to 250 SSL VPN connections from the AnyConnect client. These licenses are relatively inexpensive, currently priced around a hundred dollars with the price varying per platform. These are platform specific SKUs so make sure the one you’re buying matches the device it is going on. For example, on the 5510 make sure the license is L-ASA-AC-E-5510=. AnyConnect Essentials licenses debuted with ASA release v8.2.
Premium licenses are more complicated than Essentials. Premium licenses allow for both AnyConnect client based and clientless SSL VPN. Clientless VPN is established through a web browser. While it is typically less functional than AnyConnect client based VPN, it is adequate access for many users. Additionally, Cisco Secure Desktop (Host Scan and Vault functionality) is included. Premium licenses do not max out the unit they’re on of SSL VPN sessions as does the Essentials license. Instead, this is a per seat license that can be purchased in bulk quantities. These quantities are 10, 25, 50, 100, 250, 500, 750, 1000, 2500, 5000, 10000 with each platform being able to support only the maximum number of licenses which it supports total VPN connections (ex. 5510 supports up to 250). These tiers must be observed when adding additional licensing. For example, if an administrator needed 35 concurrent clientless connections a 50 connection pack would need to be purchased. The 10 and 25 cannot be stacked. Cisco does offer upgrade licenses to upgrade tiers. Premium licenses are significantly more expensive than Essentials. Contact your reseller for pricing on Premium licenses.
If a VPN license is activated on an ASA, it will overwrite any existing VPN license.
AnyConnect Mobile Licenses
Out of the box, ASAs do not accept connections from mobile devices such as iOS or Android systems. The AnyConnect Mobile client must be installed on the client’s device. In addition to the client, the ASA must have AnyConnect Essentials or Premium enabled and a Mobile license used in conjunction. Only one Mobile license is required per ASA. The Mobile license inherits the number of SSL users allowed by Essentials or Premium.
Summary table:
