Licensing, Upgrades and Service Contracts

[wobblycogs]

Hi,

I've just found myself thrown in at the deep end and tasked with setting up a VPN system so that our customers can get into our network to access various resources. The problem is I'm a software developer not a network admin and there's no money to pay a consultant so it's up to me to make it happen.

I've been presented with an ASA 5510 Security Plus which I've been playing with for a couple of days now. I've got a few bits configured such as SSH access, ADSM, routing between inside, DMZ and outside and some NAT/PAT forwarding. I'm currently working on setting up a basic VPN while reading the Richard Deal book.

Questions About Upgrading

I noticed this morning that there is a 8.4 version of the ASA software available. The box I have is running 8.2(5). Is it worth upgrading?

Assuming it is worth upgrading what do I need? I've been over to the Cisco download site and found what I think is the correct software but apparently I need a service contract to download it. Keeping in mind that I'll need to beg for every penny what service contract do I need and roughly how much will it cost (I'm in the UK)? It would probably help my cause if I could report a few other benefits to having a support contract as well.

Questions About VPN

My original plan was to give our customers access using AnyConnect. I'd read that all I needed was a (very reasonably priced) Essentials license and I was good to go. When I went to download what I think is the correct software though I find I need a service contract.

Is the above linked software what I need to use AnyConnect? If it is what service contract do I need?

Thanks for any help, I'm finding the licensing as complicated as the configuration!

[Jennifer Halim]

Questions About Upgrading

- If there isn't any particular feature that you are interested in version 8.4, i would not upgrade it, purely because as you advised earlier, you are not very familiar with ASA, and there are major changes in ASA version 8.3 and onwards compared to 8.2 and earlier. Since you have made yourself familiar with 8.2, you can stick with that version.

- Yes, you would need service contract to be able to download software from cisco.com download site. If you have smartnet for the ASA, then you are good to download. Asked if the ASA has smartnet included, if it does, all you need to do is to link your CCO ID to the service contract, and you will be able to download the software. Or, if someone in the organization already have access, then they can download it.

Questions About VPN

- You are right, to have full tunnel SSL VPN, all you need is the AnyConnect Essential license. The AnyConnect software itself, same as the ASA software, if you have smartnet contract, then you can download it or if someone in the organization has, they can download it.

Hope that helps.

[Marvin Rhoads · Accepted solution]

I would differ with Jennifer's advice on this one.

It will be worth your while to get and use Smartnet support. Not just for software but for configuration and problem assistance as well. The support community here is great but when you're network is having an outage relying on the helpfulness of strangers here is not the way to go.

If the ASA is relatively new and has the proper amount of memory (1 GB for a 5510) AND is new (i.e. no real old configuration that needs any migration); I'd recommend starting out with a fresh current software level. (8.4(4.1) is the most current on the 5510 platform.). I'd even upgrade it if it had a current configuration that needs migrating. The newer syntax will be used going forward and the older style will be deprecated over time. All new features will be built into the newer code with a major new release (9.0) coming out later this year.

[wobblycogs]

Thanks both for your advice it was very helpful.

I've had a bit of a read about what SmartNet provides and I think I'm going to go with Marvins advice here and sign up then upgrade to the latest 8.4. The machine is brand new (at least I took it out of a sealed box a few days ago) and has the full 1GB fitted. At the moment the configuration is just the first couple of chapters of the start up guide and my fumblings at a VPN setup, certainly noting complex.

If I could ask a follow up question about SmartNet though. I've found an online reseller (ithsc.co.uk) that looks like a quick and easy option. Is this a legitimate way to purchase SmartNet though? I'm don't want to ring TAC and find I've bought an expensive bit of useless paper.

Thanks again.

[Marvin Rhoads]

You're welcome, Graham. Thanks for the rating.

Most small business end customers go via a reseller or partner to purchase their support contract. This is entirely normal. Once you make the purchase, go straight ahead and setup your cisco.com logon ID with your service contract number. That will show you right away that you have a valid contract entitlement.