We are planning to buy ASA 5585-X SSP-10 so have question related licensing, what comes with base model? we need following feature does base model cover that without any extra license?

  • VLAN (number of 20)
  • Site-to-Site VPN (DES/AES encryption)
  • Failover (HA)
  • Basic ACL rules

I saw following link for license but confused, what is Optional in section?


  • Optional is an additional license. Additional fee must be paid. Site-to-site VPN's do not require any additional licensing. – Roger Sanghee Gold Aug 10 '17 at 1:39
  • but DES3/AES encryption does need license i believe right? – Satish Aug 10 '17 at 1:50
  • Although not certain, DES3 / AES encryption can be upgraded for free. – Roger Sanghee Gold Aug 10 '17 at 5:47
  • I'm just curious why you are asking this here, instead of asking the Cisco partner/reseller that you're going to buy from (or your local Cisco sales office). I'm sure if you start the conversation with "We are planning to buy ASA 5585-X" they are all ears and will be glad to tell you everything about it :) And after buying, if something they told you was incorrect you can hold them accountable, whereas you can hardly argue "I want my money back because someone told me on SE I didn't need an extra license"... – hertitu Aug 11 '17 at 7:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 17:31

Every Cisco ASA platform comes with a certain number of implicitly activated features and capacities as a part of the Base License. In other words, these capabilities are fixed in the given software image for the particular hardware; you cannot selectively disable them. One example of such a feature is Active/Active failover, which is always available on all Cisco ASA 5585-X appliances. Some platforms offer the optional Security Plus license, which may unlock additional features or capacities on top of the Base License. For example, you can increase the maximum concurrent firewall connection count on the Cisco ASA 5505 from 10,000 to 25,000 by installing a Security Plus license.

Source and all optional licenses/features explained here.

  • Last question can i put two ASA SSP-10 firewall module in single chassis? because we need failover so how does backplane work in that case? – Satish Aug 11 '17 at 16:13
  • @Satish The ASA 5585-X comes with a core Security Services Processor (SSP) already installed (SSP-10, SSP-20, SSP-40, or SSP-60). You can install an additional SSP (core SSP, IPS SSP, ASA CX SSP, or FirePOWER SSP) in slot 1. – user36472 Aug 11 '17 at 16:20
  • If i want to install one more ASA SSP-10 module so total will be two ASA SSP-10 module (same module slot01 and slot1) in that case they will act like independent body or there is backplane which will provide failover if one module die? just trying to understand how chassis react if slot0 (ASA SSP-10 die)? – Satish Aug 11 '17 at 16:23
  • @Satish If you install an additional SSP-10 module you can run those in redundancy mode, so if one breaks down the other will take over. – user36472 Aug 11 '17 at 16:24
  • So they will takeover IP address, if one of module die, so i don't need to configure failover just like we used to do in ASA 5550 firewall. – Satish Aug 11 '17 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.