In a project to replace the last Cisco PIXes and VPN 3000 Concentrators we have [finally], I've already spec'd out the new ASA 5515-X and 5545-X's. I have no experience with the X models; only exp with the older ASAs. These are replacing enterprise firewalls for our employees, L2L tunnels (HQ/branch), and RA VPN. Every pair of PIXes (primary/failover) and pair of VPN 3000 (clustered) will move to a single pair of ASA-X's. I am considering the CX Application & Visibility Control and Web Security Essentials option to handle all desktop/laptops and BYOD devices.
Are the AnyConnect Essentials VPN and AnyConnect Mobile licenses all that are needed to be able to do ACLs that consider device type (from some basic posture assessment of the AnyConnect client) -- no ISE in environment -- along with CX to be able to do something like block iPADs/iPhones from *.facebook.com but allow Android devices?
Besides the filtering above, the BYOD devices with AnyConnect would need to do RA VPN over IPSec if a particular device type (determined by ASA) and group membership (determined by ACS) are allowed -- SSL VPN not needed.
And are there any client-side licenses as it seems not, since the costs of those AnyConnects ASA licenses are so dirt cheap that it almost doesn't make sense for Cisco to even charge for them -- $150 ea. MSRP for the 5515 -- and have no client-side license requirements?
And, yes, I'm familiar with the EOL dates for both -- VPN 3000 past and PIX in July.