Smart Licensing for the Firepower System
Cisco Smart Licensing lets you purchase and manage a pool of licenses centrally. Unlike product authorization key (PAK) licenses, smart licenses are not tied to a specific serial number or license key. Smart licensing lets you assess your license usage and needs at a glance.
In addition, Smart Licensing does not prevent you from using product features that you have not yet purchased. You can start using a license immediately, as long as you are registered with the Cisco Smart Software Manager, and purchase the license later. This allows you to deploy and use a feature, and avoid delays due to purchase order approval.
Cisco Smart Software Manager
When you purchase one or more licenses for the Firepower Threat Defense device, you manage them in the Cisco Smart Software Manager: https://software.cisco.com/#SmartLicensing-Inventory. The Cisco Smart Software Manager lets you create a master account for your organization.
By default, your licenses are assigned to the Default Virtual Account under your master account. As the account administrator, you can create additional virtual accounts; for example, for regions, departments, or subsidiaries. Multiple virtual accounts help you manage large numbers of licenses and appliances.
Licenses and appliances are managed per virtual account; only that virtual account’s appliances can use the licenses assigned to the account. If you need additional licenses, you can transfer an unused license from another virtual account. You can also transfer appliances between virtual accounts.
When you register a device with Cisco Smart Software Manager, you create a Product Instance Registration Token in the manager, and then enter it in Firepower Device Manager. A registered device becomes associated with a virtual account based on the token that is used.
For more information about the Cisco Smart Software Manager, see the online help for the manager.
Periodic Communication with the License Authority
When you use a Product Instance Registration Token to register a Firepower Threat Defense device, the device registers with the Cisco License Authority. The License Authority issues an ID certificate for communication between the device and the License Authority. This certificate is valid for one year, although it will be renewed every six months. If an ID certificate expires (usually in nine months or a year with no communication), the device reverts to a de-registered state and licensed feature usage is suspended.
The device communicates with the License Authority on a periodic basis. If you make changes in the Cisco Smart Software Manager, you can refresh the authorization on the device so the changes immediately take effect. You also can wait for the device to communicate as scheduled. Normal license communication occurs every 30 days, but with the grace period, your device will operate for up to 90 days without calling home. You must contact the License Authority before 90 days have passed.
Smart License Types
The following table explains the licenses available for the Firepower Threat Defense device.
Your purchase of a Firepower Threat Defense device automatically includes a Base license. All additional licenses are optional.
|
License |
Duration |
Granted Capabilities |
|---|---|---|
|
Base (automatically included) |
Perpetual |
All features not covered by the optional term licenses. You must also specify whether to Allow export-controlled functionality on the products registered with this token. You can select this option only if your country meets export-control standards. This option controls your use of advanced encryption and the features that require advanced encryption. |
|
Threat |
Term-based |
Intrusion detection and prevention—Intrusion policies analyze network traffic for intrusions and exploits and, optionally, drop offending packets. File control—File policies detect and, optionally, block users from uploading (sending) or downloading (receiving) files of specific types. AMP for Firepower, which requires a Malware license, allows you to inspect and block files that contain malware. |
|
Malware |
Term-based |
File policies that check for malware, which use Cisco Advanced Malware Protection (AMP) with AMP for Firepower (network-based Advanced Malware Protection) and AMP Threat Grid. File policies can detect and block malware in files transmitted over your network. |
|
URL Filtering |
Term-based |
Category and reputation-based URL filtering. You can perform URL filtering on individual URLs without this license. |
|
RA VPN:
|
Term-based or perpetual based on license type. |
Remote access VPN configuration. Your base license must allow export-controlled functionality to configure RA VPN. You select whether you meet export requirements when you register the device. Firepower Device Manager can use any valid AnyConnect license. The available features do not differ based on license type. If you have not already purchased one, see Licensing Requirements for Remote Access VPN. Also see Cisco AnyConnect Ordering Guide, http://www.cisco.com/c/dam/en/us/products/collateral/security/anyconnect-og.pdf. |
Impact of Expired or Disabled Optional Licenses
If an optional license expires, you can continue using features that require the license. However, the license is marked out of compliance and you need to purchase the license and add it to your account to bring the license back into compliance.
If you disable an optional license, the system reacts as follows:
-
Malware license—The system stops querying the AMP cloud, and also stops acknowledging retrospective events sent from the AMP cloud. You cannot re-deploy existing access control policies if they include file policies that apply malware inspection. Note that for a very brief time after a Malware license is disabled, the system can use existing cached file dispositions. After the time window expires, the system assigns a disposition of Unavailable to those files.
-
Threat—The system no longer applies intrusion or file-control policies. You cannot re-deploy existing policies that require the license.
-
URL Filtering—Access control rules with URL category conditions immediately stop filtering URLs, and the system no longer downloads updates to URL data. You cannot re-deploy existing access control policies if they include rules with category and reputation-based URL conditions.
-
RA VPN—You cannot edit the remote access VPN configuration, but you can remove it. Users can still connect using the RA VPN configuration. However, if you change the device registration so that the system is no longer export compliant, the remote access VPN configuration stops immediately and no remote users can connect through the VPN.
Feedback