ASA 5506-X license for Site to Site VPN and Failover

yrkkmg7979 · ‎09-05-2015

Hello, there.

This is my first project.

It would be very helpful if someone answer below questions. Thank you in advance.

I want to buy two ASA 5506-Xs.

Before I pay, I just want to make sure that the licenses and equipment are right for my project.

Requirements for this project:

VPN: 3 to 5 site to site VPN connection.

Failover: Active/Standby

Management interface: ASDM

I do not need IPS and subscription etc.

Q1, which one do I have to use?

Seems like one of followings.

ASA5506-FPWR-BUN
ASA5506-K8
ASA5506-K9

Q2, Which license do I have to buy?

Security Plus License
Base License

Q3, Do I have to buy one base license for vpn and one security plus license for failover each? or buy one security plus license and that gives me Site to Site and failover function?

Q4, Is there anything I have to concern to use ASDM interface?(I know how to config, but I don't know if that requires additional license)

Karsten Iwen · ‎09-07-2015

Site-to-site VPN with up to ten peers is always supported on the ASA.
For ASDM and strong encryption with your VPNs you need a "strong-encryption" license. This license is automatically applied if you buy the "-k9" ASA.
For Failover you need "Security-Plus" on both ASAs. "Base" can't build a failover system.
More on the licenses can be found here.
Look for the ASA with the ordering-code "ASA5506-SEC-BUN-K9", that has the Sec-Plus license and strong encryption.

Alex H. · ‎06-26-2016

Hello,

I just bought ASA-5506X, and the VPN wizards are missing from the ASDM's menu.

At ASDM, the only options at the menu Wizards are:
- Startup wizard
- High availability and scalability wizard
- Unified communication wizard
- ASDM identify certificate wizard

- Packet capture wizard

Any idea why the VPN wizards are not there?

Thanks.

afaqzafar49 · ‎07-20-2017

You can also buy the below license if you have ASA5506-K9.

"L-ASA5506-SEC-PL="

It is the security plus license for ASA5506-K9 which gives high availability/redundancy and more.

Afaq Ahmad

Karsten Iwen · ‎07-20-2017

Be careful, on the 5506 you get redundancy, but not what the typical customer expects from High-Availability. There is no statefull failover and all connections drop when issuing a failover.

sciarrino · ‎12-05-2017

What about Any connect license do I need to buy for both or just one?

And what about firepower additional license if I have one?

Thanks.