Migrating from PIX/VPN 3000 to ASA

Question

In a project to replace the last Cisco PIXes and VPN 3000 Concentrators we have [finally], I've already spec'd out the new ASA 5515-X and 5545-X's. I have no experience with the X models; only exp with the older ASAs. These are replacing enterprise firewalls for our employees, L2L tunnels (HQ/branch), and RA VPN. Every pair of PIXes (primary/failover) and pair of VPN 3000 (clustered) will move to a single pair of ASA-X's. I am considering the CX Application & Visibility Control and Web Security Essentials option to handle all desktop/laptops and BYOD devices.

Are the AnyConnect Essentials VPN and AnyConnect Mobile licenses all that are needed to be able to do ACLs that consider device type (from some basic posture assessment of the AnyConnect client) -- no ISE in environment -- along with CX to be able to do something like block iPADs/iPhones from *.facebook.com but allow Android devices?

Besides the filtering above, the BYOD devices with AnyConnect would need to do RA VPN over IPSec if a particular device type (determined by ASA) and group membership (determined by ACS) are allowed -- SSL VPN not needed.

And are there any client-side licenses as it seems not, since the costs of those AnyConnects ASA licenses are so dirt cheap that it almost doesn't make sense for Cisco to even charge for them -- $150 ea. MSRP for the 5515 -- and have no client-side license requirements?

And, yes, I'm familiar with the EOL dates for both -- VPN 3000 past and PIX in July.

Answer 1

Regarding question 1 on mobile device licensing

Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate sessions. This worked and allowed my Verizon iPad Mini to connect but not my iPhone. Here is the license breakdown:

Session Type: AnyConnect

Username     : <user>                 Index        : 40
Assigned IP  : 10.10.121.1            Public IP    : 70.194.2.165
Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License      : AnyConnect Essentials, AnyConnect for Mobile
Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)RC4  DTLS-Tunnel: (1)AES128
Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1
Bytes Tx     : 3200                   Bytes Rx     : 940
Group Policy : anyconnect-split-policy
Tunnel Group : anyconnect-split-group
Login Time   : 11:46:24 EDT Fri Jun 7 2013
Duration     : 0h:01m:52s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none

Note: When configuring these settings, if you don't have the "Apply" button highlight afterwards, you will need to do something in ASDM that will activate the button and allow you to click it. None of the DAP settings for AnyConnect specifics would apply automatically nor trigger the Apply button so I could apply the settings. I had to go modify another setting, click apply, modify the setting back, click apply. This was using ASDM 7.1 on a 9.1.2 ASA5525-X.

Regarding question 2 on the licensing:

There are no client-side licensing options that I am aware of. The only license not necessarily tied to the ASA directly is the AnyConnect Premium which may be pulled off of a "server" ASA with a pool of session licenses for multiple "client" ASAs. In the end, they're applied to an ASA still.

Source:http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html