We activate Cisco licence L-ASA5585-SEC-PL (Security Plus) to enable 10G ports and everything working but now i want to deactivate that licence but i am getting this error

ciscoasa(config)# activation-key 0xf623f145 0xb4222d16 0x89719178 0xfba46111 0xffffffff
This is a permanent activation key and cannot be deactivated.

Is this permanent so we can't remove it forever? or next software upgrade will wipe it out?

How to deactivate if we don't want to use it?

  • Like it says, it cannot be deactivated or removed. – user36472 Aug 29 '17 at 12:15
  • hmmm! that is interesting.. – Satish Aug 30 '17 at 0:04
  • But why would you remove it in the first place? – user36472 Aug 30 '17 at 5:41
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 18:29

You can only deactivate Time-Based Keys as per the Cisco Documentation. The permanent key must be replaced with another permanent key with fewer features.

The activate and deactivate keywords are available for time-based keys only. If you do not enter any value, activate is the default. The last time-based key that you activate for a given feature is the active one. To deactivate any active time-based key, enter the deactivate keyword. If you enter a key for the first time, and specify deactivate, then the key is installed on the ASA in an inactive state.

The documentation also states:

You can install one permanent key, and multiple time-based keys. If you enter a new permanent key, it overwrites the already installed one.

Thus, if you wish to revert, you must overwrite the current permanent key with another permanent key with fewer features. If you do not have such a key on-hand, you will need to contact the Cisco License Team. A user in another forum reported that they were able to accomplish this successfully.

  • Make sense, let's say we i have activated license key to enable 10G interface on ASA5585-x and now i want to get Cisco Anyconnect VPN licence key in that case does Anyconnect VPN licence key overwrite my 10G license key? – Satish Sep 3 '17 at 19:05
  • Yes, that is the expected behavior. Work with the Cisco License Team, if you need a permanent license key with both features. – TDurden Sep 3 '17 at 19:17
  • That is interesting because i read somewhere VPN anyconnect licence can be shared between Active/standby unit, how does that going to work with security plus (we bought two security plus licence for both unit) tunnelsup.com/understanding-cisco-asa-anyconnect-licensing – Satish Sep 3 '17 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.