Wednesday, March 18, 2020

Staring down the barrel of a firewall cutover... Seeking guidance on AnyConnect licensing.

I'm replacing some ASA 5525s with a pair of 4110s in order to escape the 750 session max with the 5525 hardware. I'm due to cutover to the 4110s in the middle of the night and I still have some anxiety about AnyConnect licensing (due to ignorance).

Here's the "show license feature" output:

License mode: Smart Licensing Licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 1024 Inside Hosts : Unlimited Failover : Active/Active Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 10 Carrier : Disabled AnyConnect Premium Peers : 10000 AnyConnect Essentials : Disabled Other VPN Peers : 10000 Total VPN Peers : 10000 AnyConnect for Mobile : Enabled AnyConnect for Cisco VPN Phone : Enabled Advanced Endpoint Assessment : Enabled Shared License : Disabled Total TLS Proxy Sessions : 10000 Cluster : Enabled Failover cluster licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 1024 Inside Hosts : Unlimited Failover : Active/Active Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 20 Carrier : Disabled AnyConnect Premium Peers : 10000 AnyConnect Essentials : Disabled Other VPN Peers : 10000 Total VPN Peers : 10000 AnyConnect for Mobile : Enabled AnyConnect for Cisco VPN Phone : Enabled Advanced Endpoint Assessment : Enabled Shared License : Disabled Total TLS Proxy Sessions : 10000 Cluster : Enabled 

I'm interpreting this output to mean that the device is currently entitled to 10k AnyConnect sessions without applying/transferring additional licensing. Is this correct?

Just trying to avoid the surprise of having next to no throughput for AnyConnect sessions due to some obscure licensing requirement that isn't made clear in the above output.

Thanks much.



No comments:

Post a Comment