Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Hello everybody,

something is confusing me;

i red that you need only one L-ASA5510-SEC-PL for setting up a Active/Standby Failover.

I installed the license on the 1st ASA and tried to setup the failover via the ASDM wizard.

It always fails, because the 2nd device can't have a 'base' license.

So does this mean, i really need another license?

Thanks for the conclusion.

1 ACCEPTED SOLUTION

Accepted Solutions
Red

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Hi,

Yes you would need another security plus license for the standby unit, just to enable failover license on it. The rest of the features on the ASA can be different on the two devices, as in number of contexts, VPN peers, annyconnect mobile. These things can be different on the two boxes. And this features is only available on post 8.3 versions.

In pre 8.3, you needed to have the exact same license and features on the two ASA's, which is not the case in your issue. Licensing can be a bit difficult to understand but you can get all the information regarding your setup in this doc:

http://packetpushers.net/cisco-asa-licensing-explained/

http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html#wp460665

Hope that helps.

Thanks,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
5 REPLIES
Red

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Hi,

Yes, on both the ASA's you would need the exact same licenses, if you are using software version pre ASA 8.3, here are the failover requirements:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

If you are using ASA version 8.3 or higher, then follow these requirements:

http://www.cisco.com/en/US/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1455081

Hope that helps.

Thanks,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
Community Member

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Alright, but why do i get an error message then?

The devices are on 8.4.

And what is this sentence about->

"For the ASA 5505 and 5510 adaptive security appliances, both units require the Security Plus license; the Base license does not support failover, so you cannot enable failover on a standby unit that only has the Base license."

Red

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

The failover is disabled on the base license on ASA 5505 and ASA 5510, to enable failover capabilities on the device, you would need a security plus license, you can refer to the tables in this docs:

http://www.cisco.com/en/US/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1455081

Thanks,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
Community Member

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Im sorry, but then it means i need another license right? i cannot share it? For me, this makes absolutely no sense.

Red

2x ASA 5510 -> Active/Standby Failover = 2x Licenses?

Hi,

Yes you would need another security plus license for the standby unit, just to enable failover license on it. The rest of the features on the ASA can be different on the two devices, as in number of contexts, VPN peers, annyconnect mobile. These things can be different on the two boxes. And this features is only available on post 8.3 versions.

In pre 8.3, you needed to have the exact same license and features on the two ASA's, which is not the case in your issue. Licensing can be a bit difficult to understand but you can get all the information regarding your setup in this doc:

http://packetpushers.net/cisco-asa-licensing-explained/

http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html#wp460665

Hope that helps.

Thanks,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
1607
Views
5
Helpful
5
Replies
CreatePlease to create content