1

We activate Cisco licence L-ASA5585-SEC-PL (Security Plus) to enable 10G ports and everything working but now i want to deactivate that licence but i am getting this error 

ciscoasa(config)# activation-key 0xf623f145 0xb4222d16 0x89719178 0xfba46111 0xffffffff
This is a permanent activation key and cannot be deactivated.

Is this permanent so we can't remove it forever? or next software upgrade will wipe it out?

How to deactivate if we don't want to use it?

Improve this question
4
  • Like it says, it cannot be deactivated or removed.
    – user36472
    Commented Aug 29, 2017 at 12:15
  • hmmm! that is interesting..
    – Satish
    Commented Aug 30, 2017 at 0:04
  • But why would you remove it in the first place?
    – user36472
    Commented Aug 30, 2017 at 5:41
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 19, 2018 at 18:29

1 Answer 1

Reset to default
2

You can only deactivate Time-Based Keys as per the Cisco Documentation. The permanent key must be replaced with another permanent key with fewer features.

The activate and deactivate keywords are available for time-based keys only. If you do not enter any value, activate is the default. The last time-based key that you activate for a given feature is the active one. To deactivate any active time-based key, enter the deactivate keyword. If you enter a key for the first time, and specify deactivate, then the key is installed on the ASA in an inactive state.

The documentation also states:

You can install one permanent key, and multiple time-based keys. If you enter a new permanent key, it overwrites the already installed one.

Thus, if you wish to revert, you must overwrite the current permanent key with another permanent key with fewer features. If you do not have such a key on-hand, you will need to contact the Cisco License Team. A user in another forum reported that they were able to accomplish this successfully.

Improve this answer
3
  • Make sense, let's say we i have activated license key to enable 10G interface on ASA5585-x and now i want to get Cisco Anyconnect VPN licence key in that case does Anyconnect VPN licence key overwrite my 10G license key?
    – Satish
    Commented Sep 3, 2017 at 19:05
  • Yes, that is the expected behavior. Work with the Cisco License Team, if you need a permanent license key with both features.
    – TDurden
    Commented Sep 3, 2017 at 19:17
  • That is interesting because i read somewhere VPN anyconnect licence can be shared between Active/standby unit, how does that going to work with security plus (we bought two security plus licence for both unit) tunnelsup.com/understanding-cisco-asa-anyconnect-licensing
    – Satish
    Commented Sep 3, 2017 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.