The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
1.1 Purpose, Audience, and Scope
This document describes the packaging structure and ordering information for the Cisco Secure Client (Formerly AnyConnect®).
Audience: This guide is for Cisco sales teams, partners, distributors, and customers.
Scope: This ordering guide covers the following products:
● Cisco Secure Client 5
◦ Including AnyConnect Secure Mobility Client 4.x
For more detailed information, go to https://www.cisco.com/go/secureclient.
For questions on pricing, don't hesitate to get in touch with secureclient-pricing@cisco.com.
1.2 Orderability
Complimentary use of Cisco Secure Client is available for use in conjunction with an eligible Cisco solution:
● Cisco Secure Connect Choice
● Cisco Secure Connect Now
● Cisco Secure Endpoint
● Cisco Umbrella
Your contract number for the above solutions must be linked to your Cisco ID to access software downloads (see Section 6.1).
The following Cisco Secure Client licenses are available:
● Advantage subscription licenses (Unique Users) – Formerly AnyConnect Plus subscription
● Advantage perpetual licenses (Unique Users) – Formerly AnyConnect Plus perpetual
● Premier subscription licenses (Unique Users) – Formerly AnyConnect Apex subscription
● VPN Only perpetual licenses (Concurrent Connections) – Formerly AnyConnect VPN Only perpetual
The Cisco Secure Client reduces the number of endpoint applications required by our customers. Built upon AnyConnect, the Secure Client is our next generation software which introduces Cisco Secure Endpoint as a fully integrated module and offers optional Cloud Management via SecureX.
The Cisco Secure Client consistently raises the bar by making the remote-access experience easy for end users while providing the security that enterprise IT requires. It helps enable a highly secure connectivity experience across a broad set of PC and mobile devices. As mobile workers roam to different locations, they automatically resume connectivity. The always-on intelligent VPN adapts the tunneling protocol to the most efficient method, such as the Datagram Transport Layer Security (DTLS) protocol for latency-sensitive VoIP traffic or TCP-based application access. Tunneling support is also available for IP Security Internet Key Exchange version 2 (IPsec IKEv2).
The Secure Client goes well beyond traditional secure access. It offers a wide range of endpoint security services and streamlined IT operations from a single unified agent. Secure Client offers you the ability to achieve tighter security controls while helping to enable direct, highly secure, per-application access to corporate resources through mobile per-application VPN services. Cisco Secure Client also provides robust unified compliance capabilities so that an endpoint’s compromised state is less able to affect the integrity of the corporate network. Secure Client provides endpoint posture assessment and remediation capabilities for wired, wireless, and VPN environments in conjunction with Cisco Identity Services Engine (requires Secure Client Premier license and ISE Premier/Apex license). Access can be granted based on validating an endpoint’s state (antimalware, patch, disk encryption, and beyond) while out-of-compliance endpoints can have automated remediation actions or remediation actions based on policy requirements.
Network Visibility Module (Windows, macOS, and certain Android platforms) allows administrators to monitor endpoint application usage on and off premises to uncover potential behavior anomalies and to make more informed network and service design decisions. Rich contextual data from the Secure Client Network Visibility Module can be shared with a growing number of Internet Protocol Flow Information Export (IPFIX)–capable network-analysis tools.
Secure Client 5 also integrates optional Secure Endpoint functions, significantly expanding endpoint threat protection. This capability further reduces the potential of an attack from enterprise-connected hosts. Cisco Secure Endpoint is licensed separately from the Cisco Secure Client, but use of the Secure Client with the service is complimentary.
The Secure Client has built-in web security and malware threat defense capabilities when used in conjunction with Cisco Umbrella or the premises-based Cisco Secure Web Security Appliance. Along with remote access, the comprehensive and highly secure enterprise mobility solution supports web security and malware threat defense. It automatically blocks phishing and command-and-control attacks. Consistent, context- aware security policies help ensure a protected and productive work environment.
In addition to industry-leading VPN capabilities, the Secure Client supports advanced IEEE 802.1X capabilities. A single authentication framework manages user and device identity along with the network access protocols required to move smoothly from wired to wireless networks. Consistent with its VPN functionality, the client supports IEEE 802.1AE Media Access Control security (MACsec) for data confidentiality, data integrity, and data origin authentication on wired networks. Communication between trusted components of the network is protected.
2.1 Servers and Platforms
Secure Client services are used in conjunction with numerous Cisco head server platforms, including but not limited to the Cisco Secure Firewall, Identity Services Engine, Aggregation Services Routers, Cisco Merak MX Appliance (physical and virtual), and Cisco IOS® Software on Cisco Integrated Services Routers. Headend termination devices and cloud services such as Cisco Secure Connect Choice and Cisco Secure Connect Now are purchased separately, along with associated service costs and support contracts.
Secure Client 5 offers simplified licensing to meet the needs of the broad enterprise IT community as it adapts to growing end-user mobility demands. Secure Client 5 licensing is available in two simple tiers.
The first is Secure Client Advantage, which includes basic VPN services such as device and per-application VPN (including third-party IKEv2 remote access VPN headend support), trusted network detection, basic device context collection, and Federal Information Processing Standards (FIPS) compliance. Secure Client Advantage also includes other non-VPN services such as the Secure Client Network Access Manager 802.1X supplicant, and the Cisco Umbrella Roaming module. Existing Secure Client customers should think of Secure Client Advantage as similar to the previous AnyConnect Plus and Essentials licenses.
The second offer is Secure Client Premier, which includes more advanced services such as endpoint Posture (for Secure Firewall) , or ISE Posture through the Cisco Identity Services Engine), network visibility, and next-generation VPN encryption (including Suite B), Management VPN Tunnel, as well as all the capabilities of Secure Client Advantage. Existing Secure Client customers should think of Secure Client Premier as similar to previous AnyConnect Apex, Premium and Premium Shared Licenses. Secure Client Advantage and Premier licenses offer a set of features and deployment flexibility to meet your enterprise’s requirements. See Table 1 for details. For enterprises that want Secure Client only for remote access use cases, there is also the Secure Client VPN Only license. Please refer to section 4.3 for additional details on VPN Only licenses.
Complimentary use of the Cisco Secure Client is available in conjunction with the offers noted in Section 1.3.
Table 1. Secure Client Advantage and Premier License Features
| Advantage License (Formerly AnyConnect Plus) |
Premier License (Formerly AnyConnect Apex) |
| Device or system VPN |
All Advantage features with the other features in this column |
| Third-party IPsec IKEv2 remote access VPN clients |
Network Visibility Module |
| Per-application VPN |
Unified endpoint compliance and remediation (posture) |
| Cisco Umbrella Roaming |
Posture (for Secure Firewall) |
| Use with Cisco Secure Web Appliance |
Suite B or next-generation encryption |
| Network Access Manager |
ASA multicontext-mode remote access |
| Cisco Secure Endpoint (Complimentary use of client) |
SAML authentication |
| Cloud management via SecureX |
Management VPN Tunnel |
Cisco Secure Client Advantage and Premier licensing eliminates the need to purchase per headend Concurrent connections licenses and dedicated license servers. Secure Client Premier licenses include all Secure Client Advantage license functionality, so only one type of license is required for each user. Thus, the number of Advantage licenses can be smaller or greater than the number of Premier licenses. This model allows you to mix license tiers across a single environment, and it shifts licensing from Concurrent Connections to Unique Users.
Secure Client Advantage and Premier licenses are 12 to 60 month subscriptions, Secure Client Advantage licenses are also available as perpetual licenses. Software Application Support and software upgrades are included in Secure Client Advantage and Premier subscription licenses. For Secure Client Advantage perpetual licenses, as well as Secure Client VPN Only, a SWSS subscription must be purchased separately.
An active subscription or an active SWSS contract is required for all software access and technical support. Please note that support contracts for the headend termination devices (Cisco Secure Firewall, ISE, etc.) must be purchased separately. Secure Client 5 licensed customers are also entitled to earlier AnyConnect releases.
Note: The number of licenses needed for Secure Client Advantage or Premier is based on all the possible Unique Users that may use any Cisco Secure Client service. The exact number of Advantage or Premier licenses should be based on the total number of Unique Users that require the specific services associated with each license type.
All Cisco Secure Client licenses are orderable in Cisco Commerce and are listed on the Global Price List (GPL).
A contract number will be generated for all subscription licenses as well as any perpetual license ordered with a support contract. If you have an existing contract number, you may request that the new licenses be added to that contract. You don’t have to generate a new contract number. If a new contract number is generated, you will need to obtain this contract number from your Cisco authorized reseller or account team.
Please follow the instructions in Section 6.1 for ensuring that the contract is linked to your Cisco.com ID(s). If the contract is not linked you will not be able to download the Cisco Secure Client software or receive technical support.
Note: Integrated Services Routers require a Security license (L-SL-xx-SEC-K9=) in addition to a Secure Client license.
Subscription licenses
To order an Advantage subscription license, start with L-AC-PLS-LIC=
To order a Premier subscription license, start with L-AC-APX-LIC=
The quantity of users should be equal to the total number of Unique Users that will use Secure Client services for each license tier. Please note that the minimum user license size is 25.
The term length will default to 36 months. It can be adjusted by selecting Edit Service/Subscription -> Edit Subscriptions. Subscriptions can be purchased for durations between 12 and 60 months. Please note that additional discounts are offered for subscriptions between 3 and 5 years. When using the ordering method above, you will be able to co-term licenses by selecting specific start or end dates.
When purchasing licenses from a Cisco authorized reseller, your order may need to be based on the banding SKU for your particular duration and user count size. Please see Section 4.1 (Table 2) for Advantage Licenses and Section 4.2 (Table 4) for Premier licenses for the specific SKUs.
Note: You are allowed to stack Secure Client Advantage and Premier licenses and terms (including with valid AnyConnect Plus and Apex licenses and terms). This will result in the generation of multiple product activation keys, which should be registered to your Adaptive Security Appliances (ASAs). PAK registration does not apply to the Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower Next-Generation Firewall appliances running ASA software, Cisco routers, Cisco ISE, Meraki MX Appliance, or other Cisco headends. Secure Client Advantage and Premier PAKs are applied only to physical ASAs. Additional user licenses can be purchased at a later time. For customers with Firepower Threat Defense (FTD) 6.2.1 or later, please follow the instructions in Section 6.0.4 in order to share your Secure Client license with your Smart account.
Perpetual licenses
Advantage perpetual
To order Secure Client Advantage perpetual licenses, start by choosing L-AC-PLS-P-G. Next choose “Select Options” and select the count-based license option(s) based on the total number of possible Unique Users that will use Secure Client Advantage services. After selecting your user count(s), a high-quantity (99,999) expansion SKU in the format of L-AC-yyy-S-xY-zzzz is added at no cost. This SKU delivers a multiuse Product Activation Key (PAK), which can be used to support Adaptive Security Appliance VPN services throughout the enterprise. Please see Section 4.1 (Table 3) for the specific SKUs. Each ASA is registered to your PAK once per registration attempt using a quantity of 1.
VPN only perpetual
To order Secure Client VPN Only perpetual licenses, please see Section 4.3 (Table 5) for the specific SKUs. Unlike Secure Client Advantage and Premier, the Secure Client VPN Only SKUs are required per ASA headend. They cannot be shared across multiple appliances, and they should be purchased based on the maximum number of Concurrent Connections you wish to support on a particular headend device. Please make sure that the purchased license does not exceed the physical headend capacity for the particular platform.
Note: Cisco Software Support Service (SWSS) must be purchased and maintained separately for all software access and technical support.
4.1 Advantage licenses (12- to 60-month term or perpetual)
The Advantage license tier provides the following services:
● VPN functionality for PC and mobile platforms, including per-application VPN on mobile platforms, Cisco phone VPN, and third-party (non-Secure Client) IKEv2 VPN clients
● Basic endpoint context collection
● IEEE 802.1X Windows supplicant
● Cisco Cloud Web Security agent for Windows and macOS platforms (Cloud Web Security services are licensed separately.)
● Cisco Umbrella Roaming agent for Windows and macOS platforms (Umbrella Roaming services are licensed separately.)
● Cisco Secure Endpoint (Formerly AMP for Endpoints) Enabler (Cisco Secure Endpoint is licensed separately.)
● FIPS compliance
Advantage licenses are most applicable in environments previously served by the Cisco AnyConnect Plus, Essentials and Mobile licenses, as well environments serviced by other Secure Client use cases including Network Access Manager, and Cisco IOS and Cisco Secure Firewall VPN headends.
| Term License: L-AC-PLS-LIC= Refer to Table 2 for specific banding SKUs. Banding SKUs may be required when ordering from a Cisco partner. (Available for 12- to 60-month terms. The default is 36 months.) Select the license quantity matching your Unique User count— minimum 25, no maximum. |
Perpetual License: L-AC-PLS-P-G User license: AC-PLS-P-zzzz-S Perpetual license (SWSS contract required for software access and support) (zzzz = Unique Users count from Table 4) |
Table 2. Secure Client Advantage term license SKUs (Unique Users)
| Term License |
Banding SKU |
Description |
Unique User Range |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S1 |
Secure Client Advantage – 5-Year License |
25-99 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S2 |
Secure Client Advantage – 5-Year License |
100-249 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S3 |
Secure Client Advantage – 5-Year License |
250-499 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S4 |
Secure Client Advantage – 5-Year License |
500-999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S5 |
Secure Client Advantage – 5-Year License |
1,000-2,499 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S6 |
Secure Client Advantage – 5-Year License |
2,500-4,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S7 |
Secure Client Advantage – 5-Year License |
5,000-9,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S8 |
Secure Client Advantage – 5-Year License |
10,000-24,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-S9 |
Secure Client Advantage – 5-Year License |
25,000-49,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-10 |
Secure Client Advantage – 5-Year License |
50,000-99,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-5Y-11 |
Secure Client Advantage – 5-Year License |
100,000 or more |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S1 |
Secure Client Advantage – 3-Year License |
25-99 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S2 |
Secure Client Advantage – 3-Year License |
100-249 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S3 |
Secure Client Advantage – 3-Year License |
250-499 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S4 |
Secure Client Advantage – 3-Year License |
500-999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S5 |
Secure Client Advantage – 3-Year License |
1,000-2,499 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S6 |
Secure Client Advantage – 3-Year License |
2,500-4,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S7 |
Secure Client Advantage – 3-Year License |
5,000-9,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S8 |
Secure Client Advantage – 3-Year License |
10,000-24,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-S9 |
Secure Client Advantage – 3-Year License |
25,000-49,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-10 |
Secure Client Advantage – 3-Year License |
50,000-99,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-3Y-11 |
Secure Client Advantage – 3-Year License |
100,000 or more |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S1 |
Secure Client Advantage – 1-Year License |
25-99 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S2 |
Secure Client Advantage – 1-Year License |
100-249 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S3 |
Secure Client Advantage – 1-Year License |
250-499 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S4 |
Secure Client Advantage – 1-Year License |
500-999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S5 |
Secure Client Advantage – 1-Year License |
1,000-2,499 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S6 |
Secure Client Advantage – 1-Year License |
2,500-4,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S7 |
Secure Client Advantage – 1-Year License |
5,000-9,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S8 |
Secure Client Advantage – 1-Year License |
10,000-24,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-S9 |
Secure Client Advantage – 1-Year License |
25,000-49,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-10 |
Secure Client Advantage – 1-Year License |
50,000-99,999 |
| L-AC-PLS-LIC= |
L-AC-PLS-1Y-11 |
Secure Client Advantage – 1-Year License |
100,000 or more |
Table 3. Advantage perpetual SKUs (Unique Users)
| Perpetual License |
User License |
Description |
SWSS SKU |
| L-AC-PLS-P-G |
AC-PLS-P-25-S |
Secure Client Advantage – Perpetual License/25 Unique Users |
CON-ECMU-ACPL25 |
| L-AC-PLS-P-G |
AC-PLS-P-50-S |
Secure Client Advantage – Perpetual License/50 Unique Users |
CON-ECMU-ACPL50 |
| L-AC-PLS-P-G |
AC-PLS-P-100-S |
Secure Client Advantage – Perpetual License/100 Unique Users |
CON-ECMU-ACPL100 |
| L-AC-PLS-P-G |
AC-PLS-P-250-S |
Secure Client Advantage – Perpetual License/250 Unique Users |
CON-ECMU-ACPL250 |
| L-AC-PLS-P-G |
AC-PLS-P-500-S |
Secure Client Advantage – Perpetual License/500 Unique Users |
CON-ECMU-ACPL500 |
| L-AC-PLS-P-G |
AC-PLS-P-1K-S |
Secure Client Advantage – Perpetual License/1,000 Unique Users |
CON-ECMU-ACPL1K |
| L-AC-PLS-P-G |
AC-PLS-P-1500-S |
Secure Client Advantage – Perpetual License/1,500 Unique Users |
CON-ECMU-ACPL1500 |
| L-AC-PLS-P-G |
AC-PLS-P-2500-S |
Secure Client Advantage – Perpetual License/2,500 Unique Users |
CON-ECMU-ACPL2500 |
| L-AC-PLS-P-G |
AC-PLS-P-3500-S |
Secure Client Advantage – Perpetual License/3,500 Unique Users |
CON-ECMU-ACPL3500 |
| L-AC-PLS-P-G |
AC-PLS-P-5K-S |
Secure Client Advantage – Perpetual License/5,000 Unique Users |
CON-ECMU-ACPL5K |
| L-AC-PLS-P-G |
AC-PLS-P-10K-S |
Secure Client Advantage – Perpetual License/10,000 Unique Users |
CON-ECMU-ACPL10K |
| L-AC-PLS-P-G |
AC-PLS-P-25K-S |
Secure Client Advantage – Perpetual License/25,000 Unique Users |
CON-ECMU-ACPL25K |
| L-AC-PLS-P-G |
AC-PLS-P-50K-S |
Secure Client Advantage – Perpetual License/50,000 Unique Users |
CON-ECMU-ACPL50K |
| L-AC-PLS-P-G |
AC-PLS-P-100K-S |
Secure Client Advantage – Perpetual License/100,000 Unique Users |
CON-ECMU-ACPL100K |
| L-AC-PLS-P-G |
AC-PLS-P-250K-S |
Secure Client Advantage – Perpetual License/250,000 Unique Users |
CON-ECMU-ACPL250K |
Note: Advantage perpetual licenses require active Cisco Software Support Service (SWSS) for software access and technical support.
4.2 Premier licenses (12- to 60-month term)
The Secure Client Premier license tier provides the following services:
● VPN compliance and Posture (for Secure Firewall)
● Unified compliance and posture agent in conjunction with the Cisco Identity Services Engine (ISE) Premier/Apex licenses
● Next-generation encryption (Suite B) with Secure Client and third-party (non-Secure Client) IKEv2 VPN clients
● Network Visibility Module
● ASA multicontext-mode remote access
● SAML Authentication
● Management VPN Tunnel
● All Advantage services described above
Premier licenses are most applicable to environments previously served by the Cisco AnyConnect Premium, Shared, Flex, and Advanced Endpoint Assessment licenses.
| Term License: L-AC-APX-LIC= Refer to Table 4 for specific banding SKUs. Banding SKUs may be required when ordering from a Cisco partner. (Available for 12- to 60-month terms. The default is 36 months.) Select the license quantity matching your Unique User count—minimum 25, no maximum. |
Table 4. Premier term SKUs (Unique Users)
| Banding SKU |
Description |
Unique User Range |
|
| L-AC-APX-LIC= |
L-AC-APX-5Y-S1 |
Secure Client Premier – 5-Year License |
25-99 |
| L-AC-APX-LIC= |
L-AC-APX -5Y-S2 |
Secure Client Premier – 5-Year License |
100-249 |
| L-AC-APX-LIC= |
L-AC-APX -5Y-S3 |
Secure Client Premier – 5-Year License |
250-499 |
| L-AC-APX-LIC= |
L-AC-APX -5Y-S4 |
Secure Client Premier – 5-Year License |
500-999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-S5 |
Secure Client Premier – 5-Year License |
1,000-2,499 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-S6 |
Secure Client Premier – 5-Year License |
2,500-4,999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-S7 |
Secure Client Premier – 5-Year License |
5,000-9,999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-S8 |
Secure Client Premier – 5-Year License |
10,000-24,999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-S9 |
Secure Client Premier – 5-Year License |
25,000-49,999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-10 |
Secure Client Premier – 5-Year License |
50,000-99,999 |
| L-AC-APX-LIC= |
L-AC-APX-5Y-11 |
Secure Client Premier – 5-Year License |
100,000 or more |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S1 |
Secure Client Premier – 3-Year License |
25-99 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S2 |
Secure Client Premier – 3-Year License |
100-249 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S3 |
Secure Client Premier – 3-Year License |
250-499 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S4 |
Secure Client Premier – 3-Year License |
500-999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S5 |
Secure Client Premier – 3-Year License |
1,000-2,499 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S6 |
Secure Client Premier – 3-Year License |
2,500-4,999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S7 |
Secure Client Premier – 3-Year License |
5,000-9,999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S8 |
Secure Client Premier – 3-Year License |
10,000-24,999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-S9 |
Secure Client Premier – 3-Year License |
25,000-49,999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-10 |
Secure Client Premier – 3-Year License |
50,000-99,999 |
| L-AC-APX-LIC= |
L-AC-APX-3Y-11 |
Secure Client Premier – 3-Year License |
100,000 or more |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S1 |
Secure Client Premier – 1-Year License |
25-99 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S2 |
Secure Client Premier – 1-Year License |
100-249 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S3 |
Secure Client Premier – 1-Year License |
250-499 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S4 |
Secure Client Premier – 1-Year License |
500-999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S5 |
Secure Client Premier – 1-Year License |
1,000-2,499 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S6 |
Secure Client Premier – 1-Year License |
2,500-4,999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S7 |
Secure Client Premier – 1-Year License |
5,000-9,999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S8 |
Secure Client Premier – 1-Year License |
10,000-24,999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-S9 |
Secure Client Premier – 1-Year License |
25,000-49,999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-10 |
Secure Client Premier – 1-Year License |
50,000-99,999 |
| L-AC-APX-LIC= |
L-AC-APX-1Y-11 |
Secure Client Premier – 1-Year License |
100,000 or more |
4.3 VPN only licenses (perpetual)
Secure Client VPN Only licenses are purchased per ASA headend device for a specific number of maximum Concurrent Connections. Unlike Secure Client Advantage and Premier licenses, Secure Client VPN Only licenses are purchased for a specific headend device and not for the total number of Unique Users. VPN Only licenses are most applicable to environments wanting to use Secure Client exclusively for remote access VPN services but with high or unpredictable total user counts.
The VPN Only license tier provides the following services:
● VPN functionality for PC and mobile platforms, including per-application VPN on mobile platforms, Cisco phone VPN, and third-party (non-Secure Client) IKEv2 VPN clients
● VPN-only compliance and posture agent in conjunction with the Cisco Adaptive Security Appliance
● FIPS compliance
● Next-generation encryption (Suite B) with Secure Client and third-party (non-Secure Client) IKEv2 VPN clients
● SAML Authentication
Note: Secure Client VPN Only is licensed based on a single headend device and Concurrent Connections (not Unique Users). VPN Only licenses are an alternative to the Secure Client Advantage and Premier model. No other Secure Client function or service (such as Cisco Umbrella Roaming, ISE Posture, Network Visibility, or Network Access Manager) is available with the Secure Client VPN Only licenses. The VPN Only licenses cannot be transferred, rehosted, shared, combined, split, or directly upgraded to another VPN Only license size. These licenses do not coexist with Advantage, Premier, or any prior AnyConnect license.
Note: Secure Client VPN Only licenses require an active Cisco Software Support Services (SWSS) contract for software access and technical support. All ASA headends in a VPN Only license environment also must have active Secure Client SASU support contracts. During a covered Smart Net Total Care™ return material authorization (RMA) replacement of an ASA hardware device, VPN Only licenses covered under an active SWSS contract will be moved to the replacement hardware provided by Cisco.
| Perpetual License (Spare): L-AC-VPNO-xxxx= (xxxx = Concurrent Connections count from Table 4; may not exceed platform capabilities) Refer to Table 4 for specific SASU (support contract) SKUs. |
Perpetual License (ASA Option): AC-VPNO-xxxx (xxxx = Concurrent Connections count from Table 4; may not exceed platform capabilities) Refer to Table 4 for specific SWSS (support contract) SKUs. |
Table 5. VPN only SKUs (Concurrent Connections/single headend)
| Spare License |
Description |
SWSS SKU |
| L-AC-VPNO-25= |
Secure Client VPN Only – Perpetual License/25 Concurrent Connections |
CON-EMCU-ACVO25 |
| L-AC-VPNO-50= |
Secure Client VPN Only – Perpetual License/50 Concurrent Connections |
CON-EMCU-ACVO50 |
| L-AC-VPNO-100= |
Secure Client VPN Only – Perpetual License/100 Concurrent Connections |
CON-EMCU-ACVO100 |
| L-AC-VPNO-250= |
Secure Client VPN Only – Perpetual License/250 Concurrent Connections |
CON-EMCU-AVOL250 |
| L-AC-VPNO-500= |
Secure Client VPN Only – Perpetual License/500 Concurrent Connections |
CON-EMCU-ACVO500 |
| L-AC-VNPO-1K= |
Secure Client VPN Only – Perpetual License/1,000 Concurrent Connections |
CON-EMCU-ACVO1K |
| L-AC-VPNO-2500= |
Secure Client VPN Only – Perpetual License/2,500 Concurrent Connections |
CON-EMCU-ACVO2500 |
| L-AC-VPNO-5K= |
Secure Client VPN Only – Perpetual License/5,000 Concurrent Connections |
CON-EMCU-ACVO5K |
| L-AC-VPNO-10K= |
Secure Client VPN Only – Perpetual License/10,000 Concurrent Connections |
CON-EMCU-ACVO10K |
| ASA Option |
Description |
SWSS SKU |
| AC-VPNO-25 |
Secure Client VPN Only – Perpetual License/25 Concurrent Connections |
CON-EMCU-ACVA25 |
| AC-VPNO-50 |
Secure Client VPN Only – Perpetual License/50 Concurrent Connections |
CON-EMCU-ACVA50 |
| AC-VPNO-100 |
Secure Client VPN Only Perpetual License/100 Concurrent Connections |
CON-EMCU-ACVA100 |
| AC-VPNO-250 |
Secure Client VPN Only – Perpetual License/250 Concurrent Connections |
CON-EMCU-AVA250 |
| AC-VPNO-500 |
Secure Client VPN Only – Perpetual License/500 Concurrent Connections |
CON-EMCU-ACVA500 |
| AC-VPNO-1K |
Secure Client VPN Only – Perpetual License/1, Concurrent Connections |
CON-EMCU-ACVA1K |
| AC-VPNO-2500 |
Secure Client VPN Only – Perpetual License/2,500 Concurrent Connections |
CON-EMCU-ACVA2500 |
| AC-VPNO-5K |
Secure Client VPN Only – Perpetual License/5,000 Concurrent Connections |
CON-EMCU-ACVA5K |
| AC-VPNO-10K |
Secure Client VPN Only – Perpetual License/10,000 Concurrent Connections |
CON-EMCU-ACVA10K |
Note: For headend devices supporting more than 10,000 Concurrent Connections, more than one VPN Only license can be purchased to support the maximum Connection Connections capacity of the platform. For example, if the device supports 20,000 Concurrent Connections, two L-AC-VPNO-10K= licenses can be purchased. For those devices, the physical PAK registration process does not apply. Spare licenses (L-AC-VPNO-xxxx=) are sent by eDelivery. ASA Options (AC-VPNO-xxx) will be printed physically and mailed together with the ASA ordered with this option.
Support and software updates are included for the duration of all Secure Client term based licenses. Advantage perpetual and VPN Only perpetual licenses require the additional purchase of Cisco Software Support Service (SWSS) to obtain software access and technical support. Cisco Smart Net Total Care support contracts for the headend termination devices must be purchased separately.
This support entitles customers to the services listed here for the full term of the purchased software subscription:
● Software updates and major upgrades to keep the Secure Client performing optimally with the most current feature set
● Access to the Cisco Technical Assistance Center, which provides fast, specialized support
● Registered access to Cisco.com
Please refer to the following link for more detailed information regarding Cisco Software Support Service: https://www.cisco.com/c/en/us/services/technical/software-support-service-swss.html
Cisco offers a variety of license management tools at the License Management portal. A valid Cisco.com user name and password are required to use the portal.
When a Cisco Adaptive Security Appliance (ASA) is used with Secure Client, you must register each individual ASA appliance to each Secure Client Advantage or Premier license that you purchase. The license registration process should not be completed for the Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower, Cisco ISE, Cisco IOS, Meraki MX Appliance (physical and virtual), or other headends. See Section 6.0.4 for instructions on sharing your Secure Client license with your Smart account, which is required for Firepower Threat Defense (FTD) 6.2.1 and later. Contract entitlement (Section 6.1) should be completed regardless of the headend. Otherwise you will not be able to download Secure Client software or obtain tech support.
The license registration process varies depending on the license purchased.
Note: When registering a license to your ASA, it is important that you confirm the serial number for your appliance by using the “Show Version” command or the appliance’s device manager.
Note: For all Secure Client Advantage and Premier licenses, the Adaptive Security Appliance (ASA) license emailed to you after activating your key will display only the Concurrent Connections hardware user capacity of your appliance, not your purchased Unique User license count or Secure Client license tier (Advantage or Premier). To look up the user license purchased or term remaining, please access your support contract through the Cisco Service Contract Center.
6.0.1 Advantage and Premier term licenses (L-AC-PLS-LIC= or L-AC-APX-LIC=)
The Product Activation Key (PAK) is used only for the initial headend serial number(s) that you register.
For subsequent registrations, you request an activation code on the Cisco.com license portal under “Licenses - Move licenses - Share licenses - Get activation code - ASA Secure Client (AnyConnect) Term and Content.” You will be prompted to enter a source and target serial number. The source serial number can be any serial number currently sharing this license. The target serial number is the ASA serial number you wish to share it with. If the source serial number has multiple Advantage or Premier licenses, you will be able to select multiple licenses to share at once. If you have multiple co-termed licenses, each of them should be shared with all the ASA serial numbers. The ASA key itself will not change when you share multiple licenses.
After completing this process, you will be emailed an activation code and instructions to complete the sharing process. You must repeat this process for each additional ASA serial number you wish to share the license with.
Only the Cisco.com ID tied to the initial license registration process can share your license with additional devices.
6.0.2 Advantage perpetual (L-AC-PLS-P-G) licenses
The Product Activation Key (PAK) will be used for all subsequent ASA device registrations. For each PAK registration submission you can associate only one Adaptive Security Appliance (ASA) on a single license registration page.
The same Product Activation Key (PAK) can be applied to multiple appliances by repeating this process.
If you have purchased multiple license tiers or Unique User counts, register each activation key individually to all of your appliance serial numbers. A quantity of 1 should be used with all registrations.
6.0.3 VPN only (L-AC-VPNO-xxxx= and AC-VPNO=xxxx)
The PAK will be used for your ASA device registration, it is not used for any other Cisco headend device. This PAK can be used only once.
Note: This license cannot be transferred after it is registered, so please make sure you are registering the license for the correct ASA serial number from “show version.”
6.0.4 Firepower Threat Defense (FTD) 6.2.1 and later
In order to activate your Secure Client Advantage, Premier or VPN Only license(s) with Firepower Threat Defense (FTD) 6.2.1 or later, it must be shared with your Smart account. For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide. To complete the sharing process, please open up a case with Cisco Global Licensing (GLO) using this link and fill in the requested information.
If the above link is not available, you may send an email to licensing@cisco.com with the following subject and information filled in:
Subject: Secure Client Smart License Sharing Request
Message body:
Please share the below Secure Client license by provisioning Smart Secure Client entitlement to the Smart Account and Virtual Account as specified below.
Cisco Cisco.com ID:
Smart Account Name or Domain ID:
Smart Virtual Account Name: Default/Other:
Secure Client Product Activation Key (PAK):
Secure Client License Type (Advantage, Premier or VPN Only):
The above information is necessary to complete this request
6.1 Contract entitlement (Support and Software Center Access)
Support and Software Center access is included for the duration of subscription licenses. Advantage perpetual and VPN Only licenses require the additional purchase of a support contract in order for you to receive support or access software. Support for the headend Adaptive Security Appliance or other Cisco product requires an active Smart Net Total Care support contract.
To use your Cisco.com ID for support and Software Center access, you must first locate the contract number generated with your order. The contract number is not the same as your product activation key or Cisco sales order. You must obtain your contract number directly from your Cisco reseller. A contract number is usually generated within a week after your product activation key eDelivery. When an order is placed with Cisco, your authorized reseller or account team can specify an existing contract number already belonging to your organization.
If your reseller is unable to link your contract number to your Cisco.com ID, you can request that the contract be linked to your Cisco.com ID directly by mailing web-help-sr@cisco.com with your contract number and Cisco.com ID and a short note requesting the linking to be completed for full access (support and Software Center downloads). Your Cisco.com ID profile details (company, address, etc.) must match the details on the order.
6.2 Evaluation licenses
Cisco offers 4-week Secure Client Premier evaluation licenses that incorporate all Advantage license functionality. To obtain an evaluation license, please visit: https://www.cisco.com/go/license.
Select the following: Get Licenses -> Demo and Evaluation -> Security Products -> Secure Client (AnyConnect) Advantage/Premier (ASA) Demo license.
6.3 Export classification
Cisco Secure Client U.S. Export Classification: https://tools.cisco.com/legal/export/pepd/Search.do
Commodity Classification Automated Tracking System (CCATS): Self-Classified/Mass Market
U.S. Export Control Classification Number (ECCN): 5D992
U.S. Encryption Registration Number (ERN): R104011
French ANSSI declaration approval number: 1211725
6.4 Strong encryption licenses (ASA)
To obtain a free strong encryption license, please visit: https://www.cisco.com/go/license.
Get Licenses -> IPS, Crypto, Other -> Security Products -> Cisco ASA 3DES/AES License
6.5 Frequently Asked Questions (FAQ)
7. Product licensing terms and conditions
The licensing terms and conditions are listed in the Supplemental General Terms. The Cisco Secure Client privacy policy can be found at: https://www.cisco.com/web/siteassets/legal/privacy.html.
8. Additional Secure Client licensing questions
For further information, questions, and comments, please contact secureclient-pricing@cisco.com.