ความหมายและรายละเอียด Cisco ASA 9.6 License แต่ละ Features

License Notes
License Notes
Legacy VPN Licenses For pre-existing deployments, the legacy licenses are still supported, including the default license that includes 2 AnyConnect premium sessions (4 sessions for the ASA 5506-X with Security Plus, 5508-X, and 5516-X). However, you should upgrade to the AnyConnect Plus or Apex license for full compatibility.

Note    The AnyConnect Apex license is required for multiple context mode; you cannot use the default or legacy license.
AnyConnect Essentials

The AnyConnect Essentials sessions include the following VPN types:

  • SSL VPN
  • IPsec remote access VPN using IKEv2

This license does not support browser-based (clientless) SSL VPN access or Cisco Secure Desktop. For these features, activate an AnyConnect Premium license instead of the AnyConnect Essentials license.

Note    With the AnyConnect Essentials license, VPN users can use a web browser to log in, and download and start (WebLaunch) the AnyConnect client.

The AnyConnect client software offers the same set of client features, whether it is enabled by this license or an AnyConnect Premium license.

The AnyConnect Essentials license cannot be active at the same time as the following licenses on a given ASA: AnyConnect Premium license (all types) or the Advanced Endpoint Assessment license. You can, however, run AnyConnect Essentials and AnyConnect Premium licenses on different ASAs in the same network.

You can disable this license to use other licenses by using the webvpn, and then the no anyconnect-essentials command or in ASDM, using the Configuration > Remote Access VPN > Network (Client) Access > Advanced > AnyConnect Essentials pane.

AnyConnect for Cisco VPN Phone

In conjunction with an AnyConnect Premium license, this license enables access from hardware IP phones that have built in AnyConnect compatibility.

AnyConnect for Mobile

This license provides access to the AnyConnect Client for touch-screen mobile devices running Windows Mobile 5.0, 6.0, and 6.1. We recommend using this license if you want to support mobile access to AnyConnect 2.3 and later versions. This license requires activation of one of the following licenses to specify the total number of SSL VPN sessions permitted: AnyConnect Essentials or AnyConnect Premium.

Mobile Posture Support

Enforcing remote access controls and gathering posture data from mobile devices requires an AnyConnect Mobile license and either an AnyConnect Essentials or AnyConnect Premium license to be installed on the ASA. Here is the functionality you receive based on the license you install.

  • AnyConnect Premium License Functionality
    • Enforce DAP policies on supported mobile devices based on DAP attributes and any other existing endpoint attributes. This includes allowing or denying remote access from a mobile device.
  • AnyConnect Essentials License Functionality
    • Enable or disable mobile device access on a per group basis and to configure that feature using ASDM.
    • Display information about connected mobile devices via CLI or ASDM without having the ability to enforce DAP policies or deny or allow remote access to those mobile devices.
AnyConnect Premium

AnyConnect Premium sessions include the following VPN types:

  • SSL VPN
  • Clientless SSL VPN
  • IPsec remote access VPN using IKEv2
AnyConnect Premium Shared

A shared license lets the ASA act as a shared license server for multiple client ASAs. The shared license pool is large, but the maximum number of sessions used by each individual ASA cannot exceed the maximum number listed for permanent licenses.

AnyConnect Plus and Apex The AnyConnect Plus or Apex license is a multi-use license that you can apply to multiple ASAs, all of which share a user pool as specified by the license. See http://www.cisco.com/go/license, and assign the PAK separately to each ASA. When you apply the resulting activation key to an ASA, it toggles on the VPN features to the maximum allowed, but the actual number of unique users across all ASAs sharing the license should not exceed the license limit. For more information, see:

Note    The AnyConnect Apex license is required for multiple context mode.
Botnet Traffic Filter Requires a Strong Encryption (3DES/AES) License to download the dynamic database.
Carrier The Carrier license enables the following inspection features:

  • Diameter
  • GTP/GPRS
  • SCTP
Encryption The DES license cannot be disabled. If you have the 3DES license installed, DES is still available. To prevent the use of DES when you want to only use strong encryption, be sure to configure any relevant commands to use only strong encryption.
IPS module The IPS module license lets you run the IPS software module on the ASA. You also need the IPS signature subscription on the IPS side.

See the following guidelines:

  • To buy the IPS signature subscription you need to have the ASA with IPS pre-installed (the part number must include “IPS”, for example ASA5515-IPS-K9); you cannot buy the IPS signature subscription for a non-IPS part number ASA.
  • For failover, you need the IPS signature subscription on both units; this subscription is not shared in failover, because it is not an ASA license.
  • For failover, the IPS signature subscription requires a unique IPS module license per unit. Like other ASA licenses, the IPS module license is technically shared in the failover cluster license. However, because of the IPS signature subscription requirements, you must buy a separate IPS module license for each unit in failover.
Other VPN Other VPN sessions include the following VPN types:

  • IPsec remote access VPN using IKEv1
  • IPsec site-to-site VPN using IKEv1
  • IPsec site-to-site VPN using IKEv2

This license is included in the Base license.

Total VPN (sessions), combined all types
  • Although the maximum VPN sessions add up to more than the maximum VPN AnyConnect and Other VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the ASA, so be sure to size your network appropriately.
  • If you start a clientless SSL VPN session and then start an AnyConnect client session from the portal, 1 session is used in total. However, if you start the AnyConnect client first (from a standalone client, for example) and then log into the clientless SSL VPN portal, then 2 sessions are used.
Total UC Proxy Sessions Each TLS proxy session for Encrypted Voice Inspection is counted against the UC license limit.

Other applications that use TLS proxy sessions do not count toward the UC limit, for example, Mobility Advantage Proxy (which does not require a license.

Some UC applications might use multiple sessions for a connection. For example, if you configure a phone with a primary and backup Cisco Unified Communications Manager, there are 2 TLS proxy connections, so 2 UC Proxy sessions are used.

You independently set the TLS proxy limit using the tls-proxy maximum-sessions command or in ASDM, using the Configuration > Firewall > Unified Communications > TLS Proxy pane. To view the limits of your model, enter the tls-proxy maximum-sessions ? command. When you apply a UC license that is higher than the default TLS proxy limit, the ASA automatically sets the TLS proxy limit to match the UC limit. The TLS proxy limit takes precedence over the UC license limit; if you set the TLS proxy limit to be less than the UC license, then you cannot use all of the sessions in your UC license.

Note    For license part numbers ending in “K8” (for example, licenses under 250 users), TLS proxy sessions are limited to 1000. For license part numbers ending in “K9” (for example, licenses 250 users or larger), the TLS proxy limit depends on the configuration, up to the model limit. K8 and K9 refer to whether the license is restricted for export: K8 is unrestricted, and K9 is restricted.

If you clear the configuration (using the clear configure all command, for example), then the TLS proxy limit is set to the default for your model; if this default is lower than the UC license limit, then you see an error message to use the tls-proxy maximum-sessions command to raise the limit again (in ASDM, use the TLS Proxy pane). If you use failover and enter the write standby command or in ASDM, use File > Save Running Configuration to Standby Unit on the primary unit to force a configuration synchronization, the clear configure all command is generated on the secondary unit automatically, so you may see the warning message on the secondary unit. Because the configuration synchronization restores the TLS proxy limit set on the primary unit, you can ignore the warning.

You might also use SRTP encryption sessions for your connections:

  • For K8 licenses, SRTP sessions are limited to 250.
  • For K9 licenses, there is not limit.
Note    Only calls that require encryption/decryption for media are counted toward the SRTP limit; if passthrough is set for the call, even if both legs are SRTP, they do not count toward the limit.
Virtual CPU You must install a model license on the ASAv that sets the appropriate number of vCPUs. Until you install a license, throughput is limited to 100 Kbps so that you can perform preliminary connectivity tests. A model license is required for regular operation.
VLANs, Maximum For an interface to count against the VLAN limit, you must assign a VLAN to it. For example:


interface gigabitethernet 0/0.100
vlan 100

VPN Load Balancing VPN load balancing requires a Strong Encryption (3DES/AES) License.