Guest

Cisco ASA 5500-X Series Next-Generation Firewalls

Cisco Secure Remote Access: VPN Licensing Overview

This document provides an overview of the remote-access VPN licensing options available for use with Cisco® ASA 5500 Series Adaptive Security Appliances. Table 1 lists and describes these options.

Table 1. Remote-Access VPN Licensing Options for Cisco ASA 5500 Adaptive Security Appliances

License Name

Platform/Version Compatibility

Description

Sample SKUs

AnyConnect Premium SSL VPN Edition (single device)

• All ASA models (Cisco ASA 5505 to ASA 5580)
• Cisco ASA Software Release 8.0 and later
• Premium capabilities, including clientless Secure Sockets Layer (SSL) VPN, Cisco AnyConnect Secure Mobility, Cisco Secure Desktop (Host Scan and Vault), and Cisco AnyConnect Secure Mobility client connectivity; optionally provides full tunneling access to enterprise applications
• Available as premium bundles, options, spares, and upgrades
• ASA55XX-SSLYY-K9 (Bundle)
• ASA5500-SSL-XX= (Spare license)
• ASA-SSL-XX-YY= (Upgrade license)
• Available for specific license sizes (simultaneous users)

Flex Licenses (single device)

• Cisco ASA 5510 to ASA 5580 (Cisco ASA 5505 not included)
• Cisco ASA Software Release 8.0.4 and later
• 56 day temporary licenses for pandemic or business continuity (premium features)
• ASA-VPN-FL-XX=
• Available for 250, 750, 1000, 2500, 5000, and 10,000 simultaneous users

AnyConnect Premium SSL VPN Edition shared license (main device and participant device)

• Cisco ASA 5510 to ASA 5580 (Cisco ASA 5505 not included)
• Available in specific license size increments
• Cisco ASA Software Release 8.2 and later
• Same capabilities as single-device license, but SSL user count may be shared among any number of internally connected devices that have an installed participant license
• ASA-VPNS-XX= (main server)
• ASA-VPNP-55XX= (participant license required for additional devices)

AnyConnect Essentials

• All ASA models (Cisco ASA 5505 to ASA 5580)
• Cisco ASA Software Release 8.2 and later
• Cisco AnyConnect Secure Mobility client connectivity without clientless SSL VPN and Cisco Secure Desktop capabilities
• Cisco AnyConnect Secure Mobility capabilities that may be used in conjunction with a licensed Cisco IronPort™ Web Security Appliance
• Full tunneling access to enterprise applications
• ASA-AC-E-55XX=

AnyConnect Mobile

• All ASA models (Cisco ASA 5505 to ASA 5580)
• Cisco ASA Software Release 8.0.4 and later
• Enables mobile OS platform compatibility
• Required per device in addition to essentials or premium licenses
• ASA-AC-M-55XX=

Advanced Endpoint Assessment

• All ASA models (Cisco ASA 5505 to ASA 5580)
• Cisco ASA Software Release 8.0.3 and later
• Enables advanced endpoint assessment capabilities (such as auto-remediation)
• Required per device in addition to premium licenses; not available for essentials licenses
• ASA-ADV-END-SEC=

Electronic License Delivery (eDelivery)

Most licenses are available for electronic delivery; this process significantly accelerates license fulfillment time. To order a license electronically, be sure to order part number(s) that begin with "L-."

Active/Standby Configurations

Beginning with the Cisco ASA Software Release 8.3, duplicate licenses are no longer required for Active/Standby configurations. License options will be combined together.