1

We are planning to buy ASA 5585-X SSP-10 so have question related licensing, what comes with base model? we need following feature does base model cover that without any extra license?

  • VLAN (number of 20)
  • Site-to-Site VPN (DES/AES encryption)
  • Failover (HA)
  • Basic ACL rules

I saw following link for license but confused, what is Optional in section?

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/intro_license.html#wp2165146

5
  • Optional is an additional license. Additional fee must be paid. Site-to-site VPN's do not require any additional licensing. Aug 10, 2017 at 1:39
  • but DES3/AES encryption does need license i believe right?
    – Satish
    Aug 10, 2017 at 1:50
  • Although not certain, DES3 / AES encryption can be upgraded for free. Aug 10, 2017 at 5:47
  • I'm just curious why you are asking this here, instead of asking the Cisco partner/reseller that you're going to buy from (or your local Cisco sales office). I'm sure if you start the conversation with "We are planning to buy ASA 5585-X" they are all ears and will be glad to tell you everything about it :) And after buying, if something they told you was incorrect you can hold them accountable, whereas you can hardly argue "I want my money back because someone told me on SE I didn't need an extra license"...
    – hertitu
    Aug 11, 2017 at 7:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19, 2018 at 17:31

1 Answer 1

2

Every Cisco ASA platform comes with a certain number of implicitly activated features and capacities as a part of the Base License. In other words, these capabilities are fixed in the given software image for the particular hardware; you cannot selectively disable them. One example of such a feature is Active/Active failover, which is always available on all Cisco ASA 5585-X appliances. Some platforms offer the optional Security Plus license, which may unlock additional features or capacities on top of the Base License. For example, you can increase the maximum concurrent firewall connection count on the Cisco ASA 5505 from 10,000 to 25,000 by installing a Security Plus license.

Source and all optional licenses/features explained here.

11
  • Last question can i put two ASA SSP-10 firewall module in single chassis? because we need failover so how does backplane work in that case?
    – Satish
    Aug 11, 2017 at 16:13
  • @Satish The ASA 5585-X comes with a core Security Services Processor (SSP) already installed (SSP-10, SSP-20, SSP-40, or SSP-60). You can install an additional SSP (core SSP, IPS SSP, ASA CX SSP, or FirePOWER SSP) in slot 1.
    – user36472
    Aug 11, 2017 at 16:20
  • If i want to install one more ASA SSP-10 module so total will be two ASA SSP-10 module (same module slot01 and slot1) in that case they will act like independent body or there is backplane which will provide failover if one module die? just trying to understand how chassis react if slot0 (ASA SSP-10 die)?
    – Satish
    Aug 11, 2017 at 16:23
  • @Satish If you install an additional SSP-10 module you can run those in redundancy mode, so if one breaks down the other will take over.
    – user36472
    Aug 11, 2017 at 16:24
  • So they will takeover IP address, if one of module die, so i don't need to configure failover just like we used to do in ASA 5550 firewall.
    – Satish
    Aug 11, 2017 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.