Cisco ASA Licensing Explained

Cisco ASA firewall licensing used to be pretty simple, but as features were rolled out as licenses, the scheme became quite complex. The matters are further complicated since different appliances and versions change the rules. This document will help you make sense of ASA licensing, but is not intended to be used as a design guide. Make sure you work with your reseller if you are looking to deploy these features.

Security Plus

Security Plus licensing exists only on 5505 and 5510. On the 5505 it has the following effects:

  • Upgrades the maximum VPN sessions from 10 to 25.
  • Upgrades the maximum connections from 10,000 to 25,000.
  • Increases the number of VLANs from 3 to 20 and enables trunking.
  • Enables optional stateless active/standby failover.

On the 5510 it has slightly different set of features it enables:

  • Upgrades the maximum connections from 50,000 to 130,000.
  • Moves 2 of the 5 FastEthernet ports to 10/100/1000.
  • Increases the number of VLANs from 50 to 100.
  • Enables security contexts and allows for 2. Up to 5 can be supported on the 5510.
  • Enables optional active/active and active/standby failover.
  • Enables VPN clustering and load balancing.

The 5520 and up do not have Security Plus licensing. They come with the Base license and need nothing more to get the most performance out of the unit. Update: As Stojan pointed out in the comments, the 5585X series does have Security Plus licenses which enables the 10GB SFP+ slots.

5505 User Licenses

The 5505 is the only ASA which has a restriction on the number of “users” behind a firewall. A user is considered an internal device which communicates with the external VLAN. By default the 5505 ships with a 10 user license but can be upgraded to 50 or unlimited users.

SSL VPN Licenses

SSL VPN debuted on the ASA when it was first released but has evolved more than any other licensed based feature on the ASA.

SSL licenses break into two general types: Essentials and Premium. Essentials provides AnyConnect client based connections from personal computers including Windows and Mac systems. Installing an Essentials license allows for up to the maximum number of VPN sessions on the platform to be concurrently used for SSL. For example, a 5510 would immediately allow for up to 250 SSL VPN connections from the AnyConnect client. These licenses are relatively inexpensive, currently priced around a hundred dollars with the price varying per platform. These are platform specific SKUs so make sure the one you’re buying matches the device it is going on. For example, on the 5510 make sure the license is L-ASA-AC-E-5510=. AnyConnect Essentials licenses debuted with ASA release v8.2.

Premium licenses are more complicated than Essentials. Premium licenses allow for both AnyConnect client based and clientless SSL VPN. Clientless VPN is established through a web browser. While it is typically less functional than AnyConnect client based VPN, it is adequate access for many users. Additionally, Cisco Secure Desktop (Host Scan and Vault functionality) is included. Premium licenses do not max out the unit they’re on of SSL VPN sessions as does the Essentials license. Instead, this is a per seat license that can be purchased in bulk quantities. These quantities are 10, 25, 50, 100, 250, 500, 750, 1000, 2500, 5000, 10000 with each platform being able to support only the maximum number of licenses which it supports total VPN connections (ex. 5510 supports up to 250). These tiers must be observed when adding additional licensing. For example, if an administrator needed 35 concurrent clientless connections a 50 connection pack would need to be purchased. The 10 and 25 cannot be stacked. Cisco does offer upgrade licenses to upgrade tiers. Premium licenses are significantly more expensive than Essentials. Contact your reseller for pricing on Premium licenses.

If a VPN license is activated on an ASA, it will overwrite any existing VPN license. Be careful!

HA Pair License Dynamics

Prior to ASA software v8.3, licenses had to be identical on a HA pair. A 5510 with SSL VPN enabled wouldn’t pair with a 5510 lacking SSL VPN. As of v8.3, most licenses are replicated on a HA pair. On a 5505 or 5510 both ASAs require Security Plus licenses since Security Plus enables the HA functionality. SSL Essentials and Premium are replicated between licenses.

In an active/active pair, license quantities (when applicable) are merged. For example, two 5510s are in an active/active pair with 100 SSL Premium seats each. The licenses will merge to have a total of 200 SSL VPNs allowed in the pair. The combined number must be below the platform limitation. If the count exceeds the platform limit (ex. 250 SSL VPN connections on a 5510) the platform limit will be used on each.

Flex Licenses

ASA Flex licenses are temporary SSL VPN licenses for emergencies or situations where there is a temporary peak in SSL VPN connections. Each license is valid for 60 days. Perhaps these are best explained as a scenario.

XYZ Corp. had some flooding in their corporate office which houses 600 employees. They own an ASA 5520 with 50 SSL Premium licenses. Cisco’s Flex licenses will allow them to temporarily ‘burst’ the number of licenses their 5520 is enabled for. The key for 750 users is added to the 5520, starting the 60 day timer. The 5520 is now licensed to support up to 750 SSL VPN users on client based or clientless VPN. After 60 days the key will expire.

If XYZ Corp. has their building up and running again earlier than 60 days, the administrator can disable the temporary license by reactivating the permanent license they were previously using. This will pause the timer on the Flex licenses, allowing them to use the remainder of the time in the future.

Cisco’s Flex license documentation is pretty good and explains some of the gotchas around the licenses. Be sure to read it before purchasing and using the license.

AnyConnect Premium Shared Licenses

Large deployments of SSL VPN may require multiple ASAs positioned in multiple geographic areas. Shared licenses allow a single purchase of SSL VPN licenses to be used on multiple ASAs, possibly over large physical areas. Starting with software v8.2, Cisco allows the shared license to ease this situation. Shared licenses are broken into two types: main and participant. The main license starts at 500 SSL Premium sessions and scales to 100,000 sessions. The main license acts as a license pool which participants pull from in 50 session increments. A secondary ASA can act as a backup in case the primary fails. There is no specific backup license, as the ASA only requires a participant license. If there is no secondary ASA, the participant ASAs may not be able to reach the main ASA in the event of a connectivity problem. The participant ASA is able to use the sessions that were last borrowed from the main for 24 hours. Beyond 24 hours, the sessions are released. Currently connected clients are not disconnected but new connections are not allowed.

In Active/Standby mode, the server ASA is actually the ASA pair. The backup ASA would be the backup pair. The standby server in a pair wouldn’t be the shared license backup. The manual explains this concept pretty well:

“For example, you have a network with 2 failover pairs. Pair #1 includes the main licensing server. Pair #2 includes the backup server. When the primary unit from Pair #1 goes down, the standby unit immediately becomes the new main licensing server. The backup server from Pair #2 never gets used. Only if both units in Pair #1 go down does the backup server in Pair #2 come into use as the shared licensing server. If Pair #1 remains down, and the primary unit in Pair #2 goes down, then the standby unit in Pair #2 comes into use as the shared licensing server.” – http://www.cisco.com/en/US/docs/security/asa/asa84/license/license_management/license.html#wp1487930

Advanced Endpoint Assessment

Advanced Endpoint Assessment will scan a SSL VPN client using Cisco Secure Desktop for security policy compliance and attempt to remediate if the system is out of compliance. This is similar but a little less feature-rich than NAC. Licenses are simple for Advanced Endpoint Assessment. One license per ASA is required in addition to SSL Premium. If the ASA is in a HA pair, one license per pair is required if using ASA software v. 8.3(1) or later.

Security Contexts

Security Contexts are virtual firewalls. Each context allows for its own set of rules and default policies. Security Contexts are sold in quantities of 5, 10, 20, 50, 100 and cannot be stacked. Cisco sells incremental licensing to move between tiers. Note that two security contexts are used when in a HA pair.

Unified Communications Proxy Licenses

Cisco UC Proxy allows for Cisco IP phones to create a TLS tunnel between a remote phone and the ASA located at a corporate office. Typically if a secure connection between a phone and office were required, a firewall would have to sit at the user’s location. In many cases this would be a 800 series router. This deployment architecture doesn’t scale well due to management costs and cost of routers with their corresponding SMARTnet. UC Proxy bypasses the router and uses the IP phone as the VPN endpoint.

UC Proxy licenses are sold in numerous tiers ranging from 24 to 10,000 concurrent connections. The licenses cannot be stacked, but incremental licenses can be purchased.

AnyConnect Mobile Licenses

Out of the box, ASAs do not accept connections from mobile devices such as iOS or Android systems. The AnyConnect Mobile client must be installed on the client’s device. In addition to the client, the ASA must have AnyConnect Essentials or Premium enabled and a Mobile license used in conjunction. Only one Mobile license is required per ASA. The Mobile license inherits the number of SSL users allowed by Essentials or Premium.

Intercompany Media Engine

IME is a UC feature which allows for interoperability between organizations using Communications Manager. Licensing is simple, as a single IME license is required on the ASA.

Kevin Breit
Kevin Breit is a Chicago area based Design Engineer at a large VAR. He currently has his CCDA, CCNA, and CCNA Voice certifications but is looking to gain further certifications and experience.
Kevin Breit

Latest posts by Kevin Breit (see all)

  • Ryan Malayter

    My eyes are absolutely bleeding. Really, does any IT group have the staff time to manage this nonsense?

    Contrast this mess with the “batteries included” approach offered by so many other networking vendors. You buy a piece of kit for $X+maintenance, and you have all the functionality and licenses you need included. Some vendors might have one or two add-on options for filtering or IPS signature subscriptions, or maybe just a “gold” edition with more functionality such as OSPF/BGP, but it is all still reasonably straightforward.

    • http://about.me/weadon Ed Weadon

      The reason it’s complicated is that Cisco is cramming a ton of different security feature sets into a single appliance. The biggest offender is the SSL VPN licensing model which I believe is overly complex and generates way too much confusion. Additionally, SSL VPN licenses are not stackable. So, if you have 100 licenses today and you need 150 in the future you will need to purchase the 150 licenses bundle. (Unless they’ve changed that in the last 12 months since I bought SSL VPN licensing.) This makes pay-as-you-go a very expensive proposition and you will need to very carefully plan for your maximum number of clients that will connect from day one. Then have the fun time of justifying the capital cost to management. 

      *Edited to add* — All this said, it’s still easier to understand than some of the other licensing models out there by some vendors.

      • Kevin Breit

        Ed – I’d agree that the 

        • http://about.me/weadon Ed Weadon

          Ah! So they do have upgrade SKUs now! I don’t remember seeing those before – good to know. And lessens my frustration with the licensing model some. :)

          • Pmevalenzuela

            Hi I plan to buy a ASA5510-BUN-K9 (Firewall edition) as I understand it comes with 2 SSL VPN (premium) License. I need to 50 SSL VPN connections, is this the correct part number  ASA5500-SSL-50 (spare license) ? or should I get an upgrade license? what is the difference between spare and upgrade premium vpn license ?

          • Tewner

            The Included 2 SSL VPN license (
            mostly used for Remote Management or testing which VPN solution is best for your enterprise ) isn’t “upgradeable” – That’s the default license which comes with all ASA’s. You need the full ASA SSL-50 license. 

          • Eric

            I’m not sure, if you buy anyconnect essentials for 150 $, you get 150 SSL anyconnect connexion (but for client less, you need premium)

      • Ryan Malayter

        There’s noting special about the “ton of functionality” in an ASA. Dozens of vendors offer appliances with as much or more functionality. With simpler configuration and licensing. Check out sonicwalls enterprise series for example.

      • http://northlandboy.com/ Lindsay Hill

        “The reason it’s complicated is that Cisco is cramming a ton of different security feature sets into a single appliance. ”

        I’m sorry, but it’s 2013 – does enabling Gigabit (Security Plus license) really count as an amazing new security feature? That is a particularly galling sort of restriction to enforce.

  • Stojan Rancic

    Security Plus licenses for the 5585-X series firewalls also enable the 10 Gigabit Ethernet SFP+ interfaces, which are otherwise disabled.

    • Kevin Breit

      Thanks for pointing that out. When writing the article I somehow neglected to mention the 5585 series. I’ll update the post shortly with the fix.

  • Pingback: Cisco ASA Licensing Explained « Learn Networking With Me

  • http://www.jsimmons.co.uk/ Jason

    You don’t have to buy into the cisco way of doing VPN’s. There are plenty of very powerful alternatives to deploying some very effective VPN solutions apart from Cisco. If I owned cisco I would milk every cent out of the high penetration that the brand has  from the implementors and customers ( by the way that is exactly what they are doing).

  • Pingback: My Utopian Daydreams for 2012

  • John Reed

    You didn’t mention the AnyConnect VPN Phone License required (in conjunction with SSL Premium Licenses) to provide Cisco VPN Phone connectivity, similar to, but different than the UC Proxy Licenses. This allows encryption of the audio and signaling as well as the services on the phone, whereas the UC Proxy doesn’t encrypt the services on the phone. AnyConnect VPN Phone License is per ASA, similar to the AnyConnect Mobile Licenses.

  • Anant

    Dear David

    Your ASA needs to be on premium license atleast to understand client-less (web) based SSL VPN support (sessions based on the no. of SSL user license you have). Advanced Endpoint Assessment would need to be purchased at an additional cost (approx $1K per ASA) and would work if you are on premium. AnyConnect essential is only useful if you want to use IPSec or SSL VPN via AnyConnect VPN client, and utlize the max VPN peer session limit (5K in ASA5550). Hope this helps.

    Thanks
    Anant

  • Marcos

    Iam thinking in purchase a 5505, but I need dynamic pppoe with vlan tagging. Do you know what license have this service? Thanks in advance!

  • Patrick Hurley

    Kevin,

    Also for the 5505, the real problem i have without Security Plus is that the DMZ only supports talking to either the Internet or the inside but not both. I believe it’s called DMZ Restricted when show ver is entered. You might add that to this post for future reference.

    Thanks,

    Patrick

  • http://uncensored.citadel.org/ IGnatius T Foobar

    The byzantine complexity of software licensing is a good reason why everyone should use only open source software … everywhere.

  • tmg

    What is supposed to happen when you stack licences??

    I had a base 5510 to which I added Anyconnect Essentials and the activation keys showed as below:

    Licensed features for this platform:
    Maximum Physical Interfaces : Unlimited perpetual
    Maximum VLANs : 50 perpetual
    Inside Hosts : Unlimited perpetual
    Failover : Disabled perpetual
    Encryption-DES : Enabled perpetual
    Encryption-3DES-AES : Enabled perpetual
    Security Contexts : 0 perpetual
    GTP/GPRS : Disabled perpetual
    AnyConnect Premium Peers : 2 perpetual
    AnyConnect Essentials : 250 perpetual <<<<<<<<<
    Other VPN Peers : 250 perpetual
    Total VPN Peers : 250 perpetual
    Shared License : Disabled perpetual
    AnyConnect for Mobile : Disabled perpetual
    AnyConnect for Cisco VPN Phone : Disabled perpetual
    Advanced Endpoint Assessment : Disabled perpetual
    UC Phone Proxy Sessions : 2 perpetual
    Total UC Proxy Sessions : 2 perpetual
    Botnet Traffic Filter : Disabled

    but then we realised that the client order was supposed to be a 5510 Sec-Plus so we ended up having to order that licence too.

    But now the anyconnect Essentials is showing as Disabled

    Licensed features for this platform:
    Maximum Physical Interfaces : Unlimited perpetual
    Maximum VLANs : 100 perpetual
    Inside Hosts : Unlimited perpetual
    Failover : Active/Active perpetual
    Encryption-DES : Enabled perpetual
    Encryption-3DES-AES : Enabled perpetual
    Security Contexts : 2 perpetual
    GTP/GPRS : Disabled perpetual
    AnyConnect Premium Peers : 2 perpetual
    AnyConnect Essentials : Disabled perpetual <<<<<<<
    Other VPN Peers : 250 perpetual
    Total VPN Peers : 250 perpetual
    Shared License : Disabled perpetual
    AnyConnect for Mobile : Disabled perpetual
    AnyConnect for Cisco VPN Phone : Disabled perpetual
    Advanced Endpoint Assessment : Disabled perpetual
    UC Phone Proxy Sessions : 2 perpetual
    Total UC Proxy Sessions : 2 perpetual
    Botnet Traffic Filter : Disabled perpetual
    Intercompany Media Engine : Disabled perpetual
    Cluster : Disabled perpetual

    This platform has an ASA 5510 Security Plus license.

  • Syed Imtiyaz

    I am facing a problem at one of our customer’s site which has a ASA 5505 behind Internet it was working fine until last week suddenly its allowing some of the PCs to access the Internet and some of them are unable to connect it. last week the client added some of the PCs in the Internet network. I Dought if this issue is related to licensing… please kindly explain…..

    • Matthew Lattanzio

      Syed, the issue is almost assuredly related to licensing (read the section above titled “5505 User Licenses”. Your customer’s ASA either has a 10-user or 50-user license and any connections that exceed that would be blocked. You will need an upgrade license; the SKUs are: L-ASA5505-10-50 (upgrade from 10 to 50 users), L-ASA5505-10-UL (upgrade from 10 to unlimited users),and L-ASA5505-50-UL (upgrade from 50 to unlimited users), I would suggest you get the “unlimited” user license since the cost difference between it and the 50-user license is nominal. Installing the license should bring immediate relief. I hope this helps.