5

We are currently implementing a failover site at a remote location to mitigate problems caused by weather or power outages. CiscoAnyConnect is run from our ASA5510 in Home Office to allow employees to VPN into our network.

When we implement the second ASA5510 in the remote location, will we need a second Cisco AnyConnect and Hostcan and Posture module license?

Is there a command that we will need to have or setting in place to make sure it fails over properly (other than the normal protocol run between the ASA's)?

1 Answer 1

3

If you are running code versions 8.2 and before, you will need duplicate licenses, one for the Primary and one for the Secondary in an HA pair.

If you are running code versions 8.3 and after, you only need a single license, and the Primary and Secondary firewall in the HA pair will 'share' the features.

This change is outlined in the 8.3 release notes, which you can read here:

Failover licenses no longer need to be identical on each unit. The license used for both units is the combined license from the primary and secondary units.

If you happen to have had two licenses, one for each pre-8.3 Firewall in an HA pair, and then you upgraded to 8.3 or later, then the licenses will be combined. Which is to say, if you had a 5 SSL VPN user license on the Primary, and a 5 SSL VPN on the Secondary, you would now (after upgrading to 8.3+) have 10 SSL VPN users allowed to connect at once. This works for licenses which offer a numbered feature. If your license was something like AnyConnect Essentials, there is no benefit to upgrading (*see note below), since its impossible to enable the AnyConnect Essentials twice.

*There is no benefit to upgrading in so far as duplicating the licenses... I would say, however, there is significant benefit in terms of security and functionality of upgrading past 8.3. In fact, I would suggest to go all the way to 9.x+ to get cool new IPv6 features... but that is completely outside of the scope of your question.

To answer your last question... the output of show version has changed in 8.3+ and should be sufficient in determine what your firewalls in the HA pair are licensed for or not.

2
  • What protocol would I have to run if the ASA's are geographically separate?
    – HAL
    Jan 26, 2015 at 15:06
  • 1
    You wouldn't want to put a pair of Geographically separated firewalls in an Active/Standby or Active/Active configuration. You're better off doing Anycast or Global Load Balancing to split traffic between two sites. At each of those sites, you can have a pair of FW's for redundancy locally, but I wouldn't suggest trying to do High Availability with "one" firewall pair at two different physical sites. You can ask more in Chat if you want to discuss further, or create a new question.
    – Eddie
    Jan 26, 2015 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.