cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4747
Views
0
Helpful
4
Replies

VPN Premium license

boody9999
Level 1
Level 1

we have two ASA 5525-X and we know its coming with 2 VPN Premium license as default, however we configured both firewalls as Active/Standby failover.

my question is, we should have 4 VPN Premium license ?!!! as we known its merge all VPN  Premium license ?!!

Please advise? 

 

Regards,

Eng. Boody

4 Replies 4

Marvin Rhoads
Hall of Fame
Hall of Fame

I believe you should see 2 for the platform and 4 total for the HA cluster.

Assuming you have the failover pair configured and working, please share the output of:

 sh ver | i Premium

ASA#  sh ver | i Premium
AnyConnect Premium Peers          : 2              perpetual
This platform has an ASA5525 VPN Premium license.
AnyConnect Premium Peers          : 4              perpetual
This platform has an ASA5525 VPN Premium license.

 

***********************************

ASA# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: Failover_Int GigabitEthernet0/6 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 4 of 216 maximum

Version: Ours 9.1(1), Mate 9.1(1)

Last Failover at: 13:14:02 AST May 26 2014

        This host: Primary - Active

                Active time: 294357 (sec)

                slot 0: ASA5525 hw/sw rev (1.0/9.1(1)) status (Up Sys)

                  Interface Outside (x.x.x.x): Normal (Not-Monitored)

                  Interface Inside (10.10.10.1): Normal (Monitored)

                  Interface DMZ (11.11.11.1): Normal (Monitored)

                  Interface Manag (100.100.100.101): Normal (Monitored)

                  slot 1: CXSC5525 hw/sw rev (N/A/9.1.1) status (Up/Up)

                  ASA CX, 9.1.1, Up

        Other host: Secondary - Standby Ready

                Active time: 0 (sec)

                 slot 0: ASA5525 hw/sw rev (1.0/9.1(1)) status (Up Sys)

                  Interface Outside (0.0.0.0): Normal (Not-Monitored)     

                  Interface Inside (10.10.10.2): Normal (Monitored)

                  Interface DMZ (11.11.11.2): Normal (Monitored)

                  Interface Manag (100.100.100.102): Normal (Monitored)

                  Interface management (0.0.0.0): Normal (Not-Monitored)

                slot 1: CXSC5525 hw/sw rev (N/A/9.1.1) status (Up/Up)

                  ASA CX, 9.1.1, Up

 

ASA# sh failover state

 

 

               State          Last Failure Reason      Date/Time

This host  -   Primary

               Active         None

Other host -   Secondary

               Standby Ready  Comm Failure             13:14:17 AST May 26 2014

 

 

====Configuration State===

        Sync Done

====Communication State===

        Mac set

***************************

ASA# sh ver

 

Cisco Adaptive Security Appliance Software Version 9.1(1)

Device Manager Version 6.6(1)

 

Compiled on Wed 28-Nov-12 11:15 PST by builders

System image file is "disk0:/asa911-smp-k8.bin"

Config file at boot was "startup-config"

 

ASA up 35 days 19 hours

failover cluster up 35 days 19 hours

 

 

Hardware:   ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)

            ASA: 4096 MB RAM, 1 CPU (1 core)

Internal ATA Compact Flash, 8192MB

BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

 

 

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)

                             Boot microcode        : CNPx-MC-BOOT-2.00

                             SSL/IKE microcode     : CNPx-MC-SSL-PLUS-T020

                             IPSec microcode       : CNPx-MC-IPSEC-MAIN-0022

                             Number of accelerators: 1

Baseboard Management Controller (revision 0x1) Firmware Version: 2.4

 

0: Int: Internal-Data0/0    : address is 7428.ac5a.d7d9, irq 11

1: Ext: GigabitEthernet0/0  : address is 7428.ac5a.d7de, irq 5

2: Ext: GigabitEthernet0/1  : address is 7428.ac5a.d7da, irq 5

3: Ext: GigabitEthernet0/2  : address is 7428.ac5a.d7df, irq 10

4: Ext: GigabitEthernet0/3  : address is 7428.ac5a.d7db, irq 10

5: Ext: GigabitEthernet0/4  : address is 7428.ac5a.d7e0, irq 5

6: Ext: GigabitEthernet0/5  : address is 7428.ac5a.d7dc, irq 5

7: Ext: GigabitEthernet0/6  : address is 7428.ac5a.d7e1, irq 10

8: Ext: GigabitEthernet0/7  : address is 7428.ac5a.d7dd, irq 10

9: Int: Internal-Data0/1    : address is 0000.0001.0002, irq 0

10: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 0

11: Int: Internal-Data0/2    : address is 0000.0001.0003, irq 0

12: Ext: Management0/0   : address is 7428.ac5a.d7d9, irq 0

 

 

Licensed features for this platform:

Maximum Physical Interfaces       : Unlimited      perpetual

Maximum VLANs                     : 200            perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Active/Active  perpetual

Encryption-DES                    : Enabled        perpetual

Encryption-3DES-AES               : Enabled        perpetual

Security Contexts                 : 2              perpetual

GTP/GPRS                          : Disabled       perpetual

AnyConnect Premium Peers          : 2              perpetual

AnyConnect Essentials             : Disabled       perpetual

Other VPN Peers                   : 750            perpetual

Total VPN Peers                   : 750            perpetual

Shared License                    : Disabled       perpetual

AnyConnect for Mobile             : Disabled       perpetual

AnyConnect for Cisco VPN Phone    : Disabled       perpetual

Advanced Endpoint Assessment      : Disabled       perpetual

UC Phone Proxy Sessions           : 2              perpetual

Total UC Proxy Sessions           : 2              perpetual

Botnet Traffic Filter             : Disabled       perpetual

Intercompany Media Engine         : Disabled       perpetual

IPS Module                        : Disabled       perpetual

Cluster                           : Disabled       perpetual

 

 

This platform has an ASA5525 VPN Premium license.

 

Failover cluster licensed features for this platform:

Maximum Physical Interfaces       : Unlimited      perpetual

Maximum VLANs                     : 200            perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Active/Active  perpetual

Encryption-DES                    : Enabled        perpetual

Encryption-3DES-AES               : Enabled        perpetual

Security Contexts                 : 4              perpetual

GTP/GPRS                          : Disabled       perpetual

AnyConnect Premium Peers          : 4              perpetual

AnyConnect Essentials             : Disabled       perpetual

Other VPN Peers                   : 750            perpetual

Total VPN Peers                   : 750            perpetual

Shared License                    : Disabled       perpetual

AnyConnect for Mobile             : Disabled       perpetual

AnyConnect for Cisco VPN Phone    : Disabled       perpetual

Advanced Endpoint Assessment      : Disabled       perpetual

UC Phone Proxy Sessions           : 4              perpetual

Total UC Proxy Sessions           : 4              perpetual

Botnet Traffic Filter             : Disabled       perpetual

Intercompany Media Engine         : Disabled       perpetual

IPS Module                        : Disabled       perpetual

Cluster                           : Disabled       perpetual

 

 

This platform has an ASA5525 VPN Premium license.

 

Configuration register is 0x1

So it's working as designed - 2 licenses on each platform  and 4 total for the 2-unit HA pair.

Does that answer your question?

No, my problem is we can work with two users only concurrent and when we tried to use third or fourth user its give us login failed and once we log out from previous users we able to log in with third and fourth users ?!!! 

its meaning its still using the 2 licenses

we think it may work in scenario Active/Active only not with Active/Standby!!!