Licenses

This chapter provides in-depth information about the different license types, service subscriptions, licensing requirements and more.


Note

The Management Center supports either a Smart License or a legacy PAK (Product Activation Keys) license for its platform license. For more information about using the PAK license, see Configure Legacy Management Center PAK-Based Licenses.

About Licenses

Cisco Smart Licensing is a flexible licensing model that provides you with an easier, faster, and more consistent way to purchase and manage software across the Cisco portfolio and across your organization. And it’s secure—you control what users can access. With Smart Licensing you get:

  • Easy Activation: Smart Licensing establishes a pool of software licenses that can be used across the entire organization—no more PAKs (Product Activation Keys).

  • Unified Management: My Cisco Entitlements (MCE) provides a complete view into all of your Cisco products and services in an easy-to-use portal, so you always know what you have and what you are using.

  • License Flexibility: Your software is not node-locked to your hardware, so you can easily use and transfer licenses as needed.

To use Smart Licensing, you must first set up a Smart Account on Cisco Software Central (software.cisco.com).

For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide

Smart Software Manager and Accounts

When you purchase one or more licenses, you manage them in the Smart Software Manager: https://software.cisco.com/#module/SmartLicensing. The Smart Software Manager lets you create a primary account for your organization. If you do not yet have an account, click the link to set up a new account. The Smart Software Manager lets you create a primary account for your organization.

By default, your licenses are assigned to the Default Virtual Account under your primary account. As the account administrator, you can create additional virtual accounts; for example, for regions, departments, or subsidiaries. Multiple virtual accounts help you manage large numbers of licenses and devices.

You manage licenses by virtual account. Only that virtual account’s devices can use the licenses assigned to the account. If you need additional licenses, you can transfer an unused license from another virtual account. You can also transfer devices between virtual accounts.

Licensing Options for Air-Gapped Deployments

The following table compares the available licensing options for environments without internet access. Your sales representative may have additional advice for your specific situation.

Table 1. Comparison of Licensing Options for Air-Gapped Networks

Smart Software Manager On-Prem

Specific License Reservation

Scalable for a large number of products

Best for a small number of devices

Automated licensing management, usage and asset management visibility

Limited usage and asset management visibility

No incremental operational costs to add devices

Linear operational costs over time to add devices

Flexible, easier to use, less overhead

Significant administrative and manual overhead for moves, adds, and changes

Out-of-compliance status is allowed initially and at various expiration states

Out-of-compliance status impacts system functioning

For more information, see Register the Management Center with the Smart Software Manager On-Prem

For more information, see Configure Specific License Reservation (SLR)

How Licensing Works for the Management Center and Devices

The management center registers with the Smart Software Manager, and then assigns licenses for each managed device. Devices do not register directly with the Smart Software Manager.

A physical management center does not require a license for its own use. The management center virtual does require a platform license.

Periodic Communication with the Smart Software Manager

In order to maintain your product license entitlement, your product must communicate periodically with the Smart Software Manager.

You use a Product Instance Registration Token to register the management center with the Smart Software Manager. The Smart Software Manager issues an ID certificate for communication between the management center and the Smart Software Manager. This certificate is valid for one year, although it will be renewed every six months. If an ID certificate expires (after a year with no communication), the management center may be removed from your account.

The management center communicates with the Smart Software Manager on a periodic basis. If you make changes in the Smart Software Manager, you can refresh the authorization on the management center so the changes immediately take effect. You also can wait for the management center to communicate as scheduled.

Your management center must either have direct internet access to the Smart Software Manager, or use one of the options described in Licensing Options for Air-Gapped Deployments. In non-airgapped deployments, normal license communication occurs every 30 days, but with the grace period, your management center will operate for up to 90 days without contacting the Smart Software Manager. Ensure that the management center contacts the Smart Software Manager before 90 days have passed, or else the management center will revert to an unregistered state.

Evaluation Mode

Before the management center registers with the Smart Software Manager, it operates for 90 days in evaluation mode. You can assign feature licenses to managed devices, and they will remain in compliance for the duration of evaluation mode. When this period ends, the management center becomes unregistered.

If you register the management center with the Smart Software Manager, the evaluation mode ends. If you later deregister the management center, you cannot resume evaluation mode, even if you did not initially use all 90 days.

For more information about the unregistered state, see Unregistered State.


Note

You cannot receive an evaluation license for Strong Encryption (3DES/AES); you must register with the Smart Software Manager to receive the export-compliance token that enables the Strong Encryption (3DES/AES) license.

Out-of-Compliance State

The management center can become out of compliance in the following situations:

  • Over-utilization—When the managed devices or the management center virtual uses unavailable licenses.

  • License expiration—When a managed device term-based license expires.

In an out-of-compliance state, see the following effects:

  • Management Center Virtual platform license—Operation is not affected.

  • All managed device licenses—Operation is not affected.

After you resolve the licensing problem, the management center will show that it is now in compliance after its regularly scheduled authorization with the Smart Software Manager. To force an authorization, click Re-Authorize on the System (system gear icon) > Licenses > Smart Licenses page.

Unregistered State

The management center can become unregistered in the following situations:

  • Evaluation mode expiration—Evaluation mode expires after 90 days.

  • Manual deregistration of the management center

  • Lack of communication with the Smart Software Manager—The management center does not communicate with the Smart Software Manager for 1 year. Note: After 90 days, the management center authorization expires, but it can successfully resume communication within one year to automatically re-authorize. After a year, the ID certificate expires, and the management center is removed from your account so you will have to manually re-register the management center.

In an unregistered state, the management center cannot deploy any configuration changes to devices for features that require licenses.

End-User License Agreement

The Cisco end-user license agreement (EULA) and any applicable supplemental agreement (SEULA) that governs your use of this product are available from http://www.cisco.com/go/softwareterms.

License Types and Restrictions

This section describes the types of licenses available.

Table 2. Smart Licenses

License You Assign

Duration

Granted Capabilities

Essentials

Perpetual or Subscription

Note

 

Essentials subscription licenses are supported only on Threat Defense Virtual.

Except for Specific License Reservation and the Secure Firewall 3100, Essentials perpetual licenses are automatically assigned with all threat defenses.

User and application control

Switching and routing

NAT

For details, see Essentials Licenses.

IPS

Subscription

Intrusion detection and prevention

File control

Security Intelligence filtering

For details, see IPS Licenses

Malware defense

Subscription

Malware defense

Secure Malware Analytics

File storage

(IPS license is a prerequisite for a Malware defense license.)

For details, see Malware Defense Licenses and License Requirements for File and Malware Policies in the Cisco Secure Firewall Management Center Device Configuration Guide.

Carrier

Subscription for Firepower 4100/9300, Secure Firewall 3100, and Threat Defense Virtual

Diameter, GTP/GPRS, M3UA, and SCTP inspection

For details, see Carrier License.

URL Filtering

Subscription

Category and reputation-based URL filtering

For details, see URL Filtering Licenses.

(IPS license is a prerequisite for a URL Filtering license.)

Management Center Virtual

  • Regular Smart Licensing— Perpetual

  • Specific License Reservation—Subscription

The platform license determines the number of devices the management center virtual can manage.

For details, see Management Center Virtual Licenses.

Export-Controlled Features

Perpetual

Features that are subject to national security, foreign policy, and anti-terrorism laws and regulations; see Licensing for Export-Controlled Functionality.

Remote Access VPN:

  • Secure Client Premier

  • Secure Client Advantage

  • Secure Client VPN Only

Subscription or perpetual

Remote access VPN configuration. Your account must allow export-controlled functionality to configure remote access VPN. You select whether you meet export requirements when you register the device. The threat defense can use any valid Secure Client license. The available features do not differ based on license type.

For more information, see Secure Client Licenses and VPN Licensing in the Cisco Secure Firewall Management Center Device Configuration Guide.


Note

Subscription licenses are term-based licenses.

Management Center Virtual Licenses

The management center virtual requires a platform license that correlates with the number of devices it can manage.

The management center virtual supports Smart Licensing.

In regular Smart Licensing, these licenses are perpetual.

In Specific License Reservation (SLR), these licenses are subscription-based.


Note

For the add-on license requirements of your new devices on FMCv, it is recommended to migrate to a higher management center virtual model that supports additional devices.

Essentials Licenses

The Essentials license allows you to:

  • Configure your devices to perform switching and routing (including DHCP relay and NAT)

  • Configure devices as a high availability pair

  • Configure clustering

  • Implement user and application control by adding user and application conditions to access control rules

  • Update the Vulnerability database (VDB) and geolocation database (GeoDB).

  • Download intrusion rules such as SRU/LSP. However, you cannot deploy access control policy or rules that have intrusion policy to the device unless IPS license is enabled.

Secure Firewall 3100

You obtain a Essentials license when you purchase the Secure Firewall 3100.

Other Models

Except in deployments using Specific License Reservation, a Essentials license is automatically added to your account when you register a device to the management center. For Specific License Reservation, you need to add the Essentials license to your account.

Malware Defense Licenses

A Malware defense license lets you perform malware defense and Secure Malware Analytics. With this feature, you can use devices to detect and block malware in files transmitted over your network. To support this feature license, you can purchase the Malware defense (AMP) service subscription as a stand-alone subscription or in combination with IPS (TM) or IPS and URL Filtering (TMC) subscriptions. IPS license is a prerequisite for a Malware defense license.


Note

Managed devices with Malware defense licenses enabled periodically attempt to connect to the Secure Malware Analytics Cloud even if you have not configured dynamic analysis. Because of this, the device’s Interface Traffic dashboard widget shows transmitted traffic; this is expected behavior.

You configure malware defense as part of a file policy, which you then associate with one or more access control rules. File policies can detect your users uploading or downloading files of specific types over specific application protocols. Malware defense allows you to use local malware analysis and file preclassification to inspect a restricted set of those file types for malware. You can also download and submit specific file types to the Secure Malware Analytics Cloud for dynamic and Spero analysis to determine whether they contain malware. For these files, you can view the network file trajectory, which details the path the file has taken through your network. The Malware Defense license also allows you to add specific files to a file list and enable the file list within a file policy, allowing those files to be automatically allowed or blocked on detection.

Note that a Malware defense license is required only if you deploy malware defense and Secure Malware Analytics. Without a Malware defense license, the management center can receive Secure Endpoint malware events and indications of compromise (IOC) from the Secure Malware Analytics Cloud.

See also important information at License Requirements for File and Malware Policies in the Cisco Secure Firewall Management Center Device Configuration Guide.

When you disable this license:

  • The system stops querying the Secure Malware Analytics Cloud, and also stops acknowledging retrospective events sent from the Secure Malware Analytics Cloud.

  • You cannot re-deploy existing access control policies if they include malware defense configurations.

  • For a very brief time after a Malware defense license is disabled, the system can use existing cached file dispositions. After the time window expires, the system assigns a disposition of Unavailable to those files.

If the license expires, your entitlement for the above capabilities ceases and the management center moves to the out-of-compliance state.

IPS Licenses

A IPS license allows you to perform intrusion detection and prevention, file control, and Security Intelligence filtering:

  • Intrusion detection and prevention allows you to analyze network traffic for intrusions and exploits and, optionally, drop offending packets.

  • File control allows you to detect and, optionally, block users from uploading (sending) or downloading (receiving) files of specific types over specific application protocols. Malware defense, which requires a Malware defense license, allows you to inspect and block a restricted set of those file types based on their dispositions.

  • Security Intelligence filtering allows you to block —deny traffic to and from—specific IP addresses, URLs, and DNS domain names, before the traffic is subjected to analysis by access control rules. Dynamic feeds allow you to immediately block connections based on the latest intelligence. Optionally, you can use a “monitor-only” setting for Security Intelligence filtering.

You can purchase a IPS license as a stand-alone subscription (T) or in combination with URL Filtering (TC), Malware defense (TM), or both (TMC).

When you disable this license:

  • The management center stops acknowledging intrusion and file events from the affected devices. As a consequence, correlation rules that use those events as a trigger criteria stop firing.

  • The management center does not contact the internet for either Cisco-provided or third-party Security Intelligence information.

  • You cannot re-deploy existing intrusion policies until you re-enable IPS.

If the license expires, your entitlement for the above capabilities ceases and the management center moves to the out-of-compliance state.

Carrier License

The Carrier license enables the inspection of the following protocols:

  • Diameter—Diameter is an Authentication, Authorization, and Accounting (AAA) protocol used in next-generation mobile and fixed telecom networks such as EPS (Evolved Packet System) for LTE (Long Term Evolution) and IMS (IP Multimedia Subsystem). It replaces RADIUS and TACACS in these networks.

  • GTP/GPRS—GPRS Tunneling Protocol (GTP) is used in GSM, UMTS, and LTE networks for general packet radio service (GPRS) traffic. GTP provides a tunnel control and management protocol to provide GPRS network access for a mobile station by creating, modifying, and deleting tunnels. GTP also uses a tunneling mechanism for carrying user data packets.

  • M3UA—MTP3 User Adaptation (M3UA) is a client/server protocol that provides a gateway to the Signaling System 7 (SS7) network for IP-based applications that interface with the SS7 Message Transfer Part 3 (MTP3) layer. M3UA makes it possible to run the SS7 User Parts (such as ISUP) over an IP network.

  • SCTP—Stream Control Transmission Protocol (SCTP) is a transport-layer protocol that supports the SS7 protocol over IP networks. It supports the 4G LTE mobile network architecture. SCTP can handle multiple simultaneous streams, multiplexed streams, and provides more security features.


Note

After you enable this license on a device, use a FlexConfig policy to enable the protocol inspection.

The Carrier license PIDs are available per family and not per device model. You can enable this license for each device either in the evaluation mode or with a Smart License.

The Carrier license for Firepower 4100/9300, Secure Firewall 3100, and Threat Defense Virtual is term-based. This license also supports Specific License Reservation.

Supported Devices

The devices that support the Carrier License are:

  • Secure Firewall 3110

  • Secure Firewall 3120

  • Secure Firewall 3130

  • Secure Firewall 3140

  • Firepower 4112

  • Firepower 4115

  • Firepower 4125

  • Firepower 4145

  • Firepower 9300

  • Threat Defense Virtual

URL Filtering Licenses

The URL Filtering license allows you to write access control rules that determine the traffic that can traverse your network based on URLs requested by monitored hosts, correlated with information about those URLs. To support this feature license, you can purchase the URL Filtering service subscription as a stand-alone subscription or in combination with IPS (TC) or Threat and Malware defense (TMC) subscriptions. IPS license is a prerequisite for this license.


Tip

Without a URL Filtering license, you can specify individual URLs or groups of URLs to allow or block. This option gives you granular, custom control over web traffic, but does not allow you to use URL category and reputation data to filter network traffic.

Although you can add category and reputation-based URL conditions to access control rules without a URL Filtering license, the management center will not download URL information. You cannot deploy the access control policy until you first add a URL Filtering license to the management center, then enable it on the devices targeted by the policy.

When you disable this license:

  • You may lose access to URL filtering.

  • Access control rules with URL conditions immediately stop filtering URLs.

  • Your management center can no longer download updates to URL data.

  • You cannot re-deploy existing access control policies if they include rules with category and reputation-based URL conditions.

If the license expires, your entitlement for the above capabilities ceases and the management center moves to the out-of-compliance state.

Secure Client Licenses

You can configure remote access VPN using the Secure Client and standards-based IPSec/IKEv2.

To enable remote access VPN, you must purchase and enable one of the following licenses: Secure Client Advantage, Secure Client Premier, or Secure Client VPN Only. You can select Secure Client Advantage and Secure Client Premier if you have both licenses and you want to use them both. The Secure Client VPN Onlylicense cannot be used with Apex or Plus. The Secure Client license must be shared with the Smart Account. For more instructions, see http://www.cisco.com/c/dam/en/us/products/collateral/security/anyconnect-og.pdf.

You cannot deploy the remote access VPN configuration to the device if the specified device does not have the entitlement for a minimum of one of the specified Secure Client license types. If the registered license moves out of compliance or entitlements expire, the system displays licensing alerts and health events.

While using remote access VPN, your Smart Account must have the export controlled features (strong encryption) enabled. The threat defense requires strong encryption (which is higher than DES) for successfully establishing remote access VPN connections with Secure Clients.

You cannot deploy remote access VPN if the following are true:

  • Smart Licensing on the management center is running in evaluation mode.

  • Your Smart Account is not configured to use export-controlled features (strong encryption).

Licensing for Export-Controlled Functionality

Features that require export-controlled functionality

Certain software features are subject to national security, foreign policy, and anti-terrorism laws and regulations. These export-controlled features include:

  • Security certifications compliance

  • Remote access VPN

  • Site-to-site VPN with strong encryption

  • SSH platform policy with strong encryption

  • SSL policy with strong encryption

  • Functionality such as SNMPv3 with strong encryption

How to determine whether export-controlled functionality is currently enabled for your system

To determine whether export-controlled functionality is currently enabled for your system: Go to System > Licenses > Smart Licenses and see if Export-Controlled Features displays Enabled.

About enabling export-controlled functionality

If Export-Controlled Features shows Disabled and you want to use features that require strong encryption, there are two ways to enable strong cryptographic features. Your organization may be eligible for one or the other (or neither), but not both.

  • If there is no option to enable export-controlled functionality when you generate a new Product Instance Registration Token in the Smart Software Manager, contact your account representative.

    When approved by Cisco, you can manually add a strong encryption license to your account so you can use export-controlled features. For more information, see Enable the Export Control Feature for Accounts Without Global Permission

  • If the option “Allow export-controlled functionality on the products registered with this token” appears when you generate a new Product Instance Registration Token in the Smart Software Manager, make sure you check it before generating the token.

    If you did not enable export-controlled functionality for the Product Instance Registration Token that you used to register the management center, then you must deregister and then re-register the management center using a new Product Instance Registration Token with export-controlled functionality enabled.

If you registered devices to the management center in evaluation mode or before you enabled strong encryption on the management center, reboot each managed device to make strong encryption available. In a high availability deployment, the active and standby devices must be rebooted together to avoid an Active-Active condition.

The entitlement is perpetual and does not require a subscription.

More Information

For general information about export controls, see https://www.cisco.com/c/en/us/about/legal/global-export-trade.html.

Threat Defense Virtual Licenses

This section describes the performance-tiered license entitlements available for the threat defense virtual.

Any threat defense virtual license can be used on any supported threat defense virtual vCPU/memory configuration. This allows threat defense virtual customers to run on a wide variety of VM resource footprints. This also increases the number of supported AWS and Azure instances types. When configuring the threat defense virtual VM, the maximum supported number of cores (vCPUs) is 16 ; and the maximum supported memory is 32 GB RAM .

Performance Tiers for Threat Defense Virtual Smart Licensing

Session limits for RA VPNs are determined by the installed threat defense virtual platform entitlement tier, and enforced via a rate limiter. The following table summarizes the session limits based on the entitlement tier and rate limiter.

Table 3. Threat Defense Virtual Licensed Feature Limits Based on Entitlement

Performance Tier

Device Specifications (Core/RAM)

Rate Limit

RA VPN Session Limit

FTDv5, 100Mbps

4 core/8 GB

100Mbps

50

FTDv10, 1Gbps

4 core/8 GB

1Gbps

250

FTDv20, 3Gbps

4 core/8 GB

3Gbps

250

FTDv30, 5Gbps

8 core/16 GB

5Gbps

250

FTDv50, 10Gbps

12 core/24 GB

10Gbps

750

FTDv100, 16Gbps

16 core/32 GB

16Gbps

10,000
Threat Defense Virtual Performance Tier Licensing Guidelines and Limitations

Please keep the following guidelines and limitations in mind when licensing your threat defense virtual device.

  • The threat defense virtual supports performance-tiered licensing that provides different throughput levels and VPN connection limits based on deployment requirements.

  • Any threat defense virtual license can be used on any supported threat defense virtual core/memory configuration. This allows the threat defense virtual customers to run on a wide variety of VM resource footprints.

  • You can select a performance tier when you deploy the threat defense virtual, whether your device is in evaluation mode or is already registered with Cisco Smart Software Manager.


    Note

    Make sure your Smart Licensing account contains the available licenses you need. It’s important to choose the tier that matches the license you have in your account. If you are upgrading your threat defense virtual to Version 7.0, you can choose FTDv - Variable to maintain your current license compliance. Your threat defense virtual continues to perform with session limits based on your device capabilities (number of cores/RAM).

  • The default performance tier is FTDv50 when deploying a new threat defense virtual device, or when provisioning the threat defense virtual using the REST API.

  • Essentials licenses are subscription-based and mapped to performance tiers. Your virtual account needs to have the Essentials license entitlements for the threat defense virtual devices, as well as for IPS, Malware Defense, and URL Filtering licenses.

  • Each HA peer consumes one entitlement, and the entitlements on each HA peer must match, including Essentials license.

  • A change in performance tier for an HA pair should be applied to the primary peer.

  • You assign feature licenses to the cluster as a whole, not to individual nodes. However, each node of the cluster consumes a separate license for each feature. The clustering feature itself does not require any licenses.

  • Universal PLR licensing is applied to each device in an HA pair separately. The secondary device will not automatically mirror the performance tier of the primary device. It must be updated manually.

License PIDs

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Software License account. However, if you need to add licenses yourself, use the Find Products and Solutions search field on the Cisco Commerce Workspace. Search for the following license Product IDs (PIDs).
Figure 1. License Search
Management Center Virtual PIDs

  • VMware:

    • SF-FMC-VMW-2-K9—2 devices

    • SF-FMC-VMW-10-K9—10 devices

    • SF-FMC-VMW-K9—25 devices

    • SF-FMC-VMW-300-K9—300 devices

  • KVM:

    • SF-FMC-KVM-2-K9—2 devices

    • SF-FMC-KVM-10-K9—10 devices

    • SF-FMC-KVM-K9—25 devices

  • PAK-based VMware:

    • FS-VMW-2-SW-K9—2 devices

    • FS-VMW-10-SW-K9—10 devices

    • FS-VMW-SW-K9—25 devices

Threat Defense Virtual PIDs

When you order FTDV-SEC-SUB, you must choose a Essentials license and optional feature licenses (12 month term):

  • Essentials license:

    • FTD-V-5S-BSE-K9

    • FTD-V-10S-BSE-K9

    • FTD-V-20S-BSE-K9

    • FTD-V-30S-BSE-K9

    • FTD-V-50S-BSE-K9

    • FTD-V-100S-BSE-K9

  • IPS, Malware defense, and URL license combination:

    • FTD-V-5S-TMC

    • FTD-V-10S-TMC

    • FTD-V-20S-TMC

    • FTD-V-30S-TMC

    • FTD-V-50S-TMC

    • FTD-V-100S-TMC

  • Carrier—FTDV_CARRIER

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Firepower 1010 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-FPR1010T-TMC=

    When you add the above PID to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR1010T-TMC-1Y

    • L-FPR1010T-TMC-3Y

    • L-FPR1010T-TMC-5Y

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Firepower 1100 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-FPR1120T-TMC=

    • L-FPR1140T-TMC=

    • L-FPR1150T-TMC=

    When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR1120T-TMC-1Y

    • L-FPR1120T-TMC-3Y

    • L-FPR1120T-TMC-5Y

    • L-FPR1140T-TMC-1Y

    • L-FPR1140T-TMC-3Y

    • L-FPR1140T-TMC-5Y

    • L-FPR1150T-TMC-1Y

    • L-FPR1150T-TMC-3Y

    • L-FPR1150T-TMC-5Y

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Firepower 2100 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-FPR2110T-TMC=

    • L-FPR2120T-TMC=

    • L-FPR2130T-TMC=

    • L-FPR2140T-TMC=

    When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR2110T-TMC-1Y

    • L-FPR2110T-TMC-3Y

    • L-FPR2110T-TMC-5Y

    • L-FPR2120T-TMC-1Y

    • L-FPR2120T-TMC-3Y

    • L-FPR2120T-TMC-5Y

    • L-FPR2130T-TMC-1Y

    • L-FPR2130T-TMC-3Y

    • L-FPR2130T-TMC-5Y

    • L-FPR2140T-TMC-1Y

    • L-FPR2140T-TMC-3Y

    • L-FPR2140T-TMC-5Y

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Secure Firewall 3100 PIDs

  • Essentials license:

    • L-FPR3110-BSE=

    • L-FPR3120-BSE=

    • L-FPR3130-BSE=

    • L-FPR3140-BSE=

  • IPS, Malware defense, and URL license combination:

    • L-FPR3110T-TMC=

    • L-FPR3120T-TMC=

    • L-FPR3130T-TMC=

    • L-FPR3140T-TMC=

    When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR3105T-TMC-1Y

    • L-FPR3105T-TMC-3Y

    • L-FPR3105T-TMC-5Y

    • L-FPR3110T-TMC-1Y

    • L-FPR3110T-TMC-3Y

    • L-FPR3110T-TMC-5Y

    • L-FPR3120T-TMC-1Y

    • L-FPR3120T-TMC-3Y

    • L-FPR3120T-TMC-5Y

    • L-FPR3130T-TMC-1Y

    • L-FPR3130T-TMC-3Y

    • L-FPR3130T-TMC-5Y

    • L-FPR3140T-TMC-1Y

    • L-FPR3140T-TMC-3Y

    • L-FPR3140T-TMC-5Y

  • Carrier—L-FPR3K-FTD-CAR=

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Firepower 4100 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-FPR4112T-TMC=

    • L-FPR4115T-TMC=

    • L-FPR4125T-TMC=

    • L-FPR4145T-TMC=

    When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR4112T-TMC-1Y

    • L-FPR4112T-TMC-3Y

    • L-FPR4112T-TMC-5Y

    • L-FPR4115T-TMC-1Y

    • L-FPR4115T-TMC-3Y

    • L-FPR4115T-TMC-5Y

    • L-FPR4125T-TMC-1Y

    • L-FPR4125T-TMC-3Y

    • L-FPR4125T-TMC-5Y

    • L-FPR4145T-TMC-1Y

    • L-FPR4145T-TMC-3Y

    • L-FPR4145T-TMC-5Y

  • Carrier—L-FPR4K-FTD-CAR=

  • Cisco Secure Client—See the Cisco Secure Client Ordering Guide.

Firepower 9300 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-FPR9K-40T-TMC=

    • L-FPR9K-48T-TMC=

    • L-FPR9K-56T-TMC=

    When you add one of the above PIDs to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-FPR9K-40T-TMC-1Y

    • L-FPR9K-40T-TMC-3Y

    • L-FPR9K-40T-TMC-5Y

    • L-FPR9K-48T-TMC-1Y

    • L-FPR9K-48T-TMC-3Y

    • L-FPR9K-48T-TMC-5Y

    • L-FPR9K-56T-TMC-1Y

    • L-FPR9K-56T-TMC-3Y

    • L-FPR9K-56T-TMC-5Y

  • Carrier—L-FPR9K-FTD-CAR=

  • Cisco Secure Client—See the Cisco AnyConnect Ordering Guide.

ISA 3000 PIDs

  • IPS, Malware defense, and URL license combination:

    • L-ISA3000T-TMC=

    When you add the above PID to your order, you can then choose a term-based subscription corresponding with one of the following PIDs:

    • L-ISA3000T-TMC-1Y

    • L-ISA3000T-TMC-3Y

    • L-ISA3000T-TMC-5Y

  • Cisco Secure Client—See the Cisco AnyConnect Ordering Guide.

Requirements and Prerequisites for Licensing

For Specific License Reservation requirements, see Requirements and Prerequisites for Specific License Reservation.

General Prerequisites

  • Make sure NTP is configured on the management center and managed devices. Time must be synchronized for registration to succeed.

    For a Firepower 4100/9300, you must configure NTP on the chassis using the same NTP server for the chassis as for the management center.

Supported Domains

Global, except where indicated.

User Roles

  • Admin

Requirements and Prerequisites for Licensing for High Availability, Clustering, and Multi-Instance

This section describes the licensing requirements for High Availability (for device High Availability and also management center virtual High Availability), clustering, and multi-instance deployments.

Licensing for Management Center High Availability

Each device requires the same licenses whether managed by a single management center or by management centers in a high availability pair (hardware or virtual).

Example: If you want to enable advanced malware protection for two devices managed by a management center pair, buy two Malware Defense licenses and two TM subscriptions, register the active management center with the Smart Software Manager, then assign the licenses to the two devices on the active management center.

Only the active management center is registered with the Smart Software Manager. When failover occurs, the system communicates with Smart Software Manager to release the license entitlements from the originally-active management center and assign them to the newly-active management center.

In Specific License Reservation deployments, only the primary management center requires a Specific License Reservation.

Hardware Management Center

No special license is required for hardware management centers in a high availability pair.

Management Center Virtual

You will need two identically licensed management center virtuals.

Example: For the management center virtual high availability pair managing 10 devices, you can use:

  • Two (2) management center virtual 10 entitlements

  • 10 device licenses

If you break the high availability pair, the management center virtual entitlements associated with the secondary management center virtual are released. (In the example, you would then have two standalone management center virtual 10s.)

Licensing for Device High-Availability

Both threat defense units in a high availability configuration must have the same licenses.

High availability configurations require two license entitlements: one for each device in the pair.

Before high availability is established, it does not matter which licenses are assigned to the secondary/standby device. During high availability configuration, the management center releases any unnecessary licenses assigned to the standby unit and replaces them with identical licenses assigned to the primary/active unit. For example, if the active unit has a Essentials license and a IPS license, and the standby unit has only a Essentials license, the management center communicates with the Smart Software Manager to obtain an available IPS license from your account for the standby unit. If your license account does not include enough purchased entitlements, your account becomes Out-of-Compliance until you purchase the correct number of licenses.

Licensing for Device Clusters

Each threat defense virtual cluster node requires the same performance tier license. We recommend using the same number of CPUs and memory for all members, or else performance will be limited on all nodes to match the least capable member. The throughput level will be replicated from the control node to each data node so they match.

You assign feature licenses to the cluster as a whole, not to individual nodes. However, each node of the cluster consumes a separate license for each feature. The clustering feature itself does not require any licenses.

When you add the control node to the management center, you can specify the feature licenses you want to use for the cluster. Before you create the cluster, it doesn't matter which licenses are assigned to the data nodes; the license settings for the control node are replicated to each of the data nodes. You can modify licenses for the cluster in the Devices > Device Management > Cluster > License area.


Note

If you add the cluster before the management center is licensed (and running in Evaluation mode), then when you license the management center, you can experience traffic disruption when you deploy policy changes to the cluster. Changing to licensed mode causes all data units to leave the cluster and then rejoin.

Licensing for Multi-Instance Deployments

All licenses are consumed per security engine/chassis (for the Firepower 4100) or per security module (for the Firepower 9300), and not per container instance. See the following details:

  • Essentials licenses are automatically assigned: one per security module/engine.

  • Feature licenses are manually assigned to each instance; but you only consume one license per feature per security module/engine. For example, for the Firepower 9300 with 3 security modules, you only need one URL Filtering license per module for a total of 3 licenses, regardless of the number of instances in use.

For example:

Table 4. Sample License Usage for Container Instances on a Firepower 9300

Firepower 9300

Instance

Licenses

Security Module 1

Instance 1

Essentials, URL Filtering, Malware Defense

Instance 2

Essentials, URL Filtering

Instance 3

Essentials, URL Filtering

Security Module 2

Instance 4

Essentials, IPS

Instance 5

Essentials, URL Filtering, Malware Defense, IPS

Security Module 3

Instance 6

Essentials, Malware Defense, IPS

Instance 7

Essentials, IPS
Table 5. Total Number of Licenses

Essentials

URL Filtering

Malware Defense

IPS

3

2

3

2

Create a Smart Account and Add Licenses

You should set up this account before you purchase licenses.

Before you begin

Your account representative or reseller may have set up a Smart Account on your behalf. If so, obtain the necessary information to access the account from that person instead of using this procedure, then verify that you can access the account.

For general information about Smart Accounts, see http://www.cisco.com/go/smartaccounts.

Procedure

Step 1

Request a Smart Account:

For instructions, see https://community.cisco.com/t5/licensing-enterprise-agreements/request-a-smart-account-for-customers/ta-p/3636515?attachment-id=150577 .

For additional information, see https://communities.cisco.com/docs/DOC-57261.

Step 2

Wait for an email telling you that your Smart Account is ready to set up. When it arrives, click the link it contains, as directed.

Step 3

Set up your Smart Account:

Go here: https://software.cisco.com/software/company/smartaccounts/home?route=module/accountcreation.

For instructions, see https://community.cisco.com/t5/licensing-enterprise-agreements/complete-smart-account-setup-for-customers/ta-p/3636631?attachment-id=132604.

Step 4

Verify that you can access the account in the Smart Software Manager.

Go to https://software.cisco.com/#module/SmartLicensing and sign in.

Step 5

Make sure your Smart Licensing account contains the available licenses you need.

When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Account. However, if you need to add licenses yourself, see Cisco Commerce Workspace. For license PIDs, see License PIDs.

Configure Smart Licensing

This section describes how to use Smart Licensing using the Smart Software Manager or the Smart Software Manager On-Prem. To use Specific License Reservation, see Configure Specific License Reservation (SLR).

Register the Management Center for Smart Licensing

You can register the management center directly to the Smart Software Manager over the internet, or when using an air-gapped network, with the Smart Software Manager On-Prem.

Register the Management Center with the Smart Software Manager

Register the management center with the Smart Software Manager.

Before you begin

  • Make sure your Smart Licensing account contains the available licenses you need.

    When you bought your device from Cisco or a reseller, your licenses should have been linked to your Smart Account. However, if you need to add licenses yourself, see Cisco Commerce Workspace. For license PIDs, see License PIDs.

  • Ensure that the management center can reach the Smart Software Manager at tools.cisco.com:443.

  • Make sure you configure NTP. During registration, a key exchange occurs between the Smart Agent and the Smart Software Manager, so time must be in sync for proper registration.

    For the Firepower 4100/9300, you must configure NTP on the chassis using the same NTP server for the chassis as for the management center.

  • If your organization has multiple management centers, make sure each management center has a unique name that clearly identifies and distinguishes it from other management centers that may be registered to the same virtual account. This name is critical for managing your Smart License entitlements and ambiguous names will lead to problems later.

Procedure

Step 1

In the Smart Software Manager, request and copy a registration token for the virtual account to which you want to add this device.

  1. Click Inventory.

  2. On the General tab, click New Token.

  3. On the Create Registration Token dialog box enter the following settings, and then click Create Token:

    • Description

    • Expire After—Cisco recommends 30 days.

    • Max. Number of Uses

    • Allow export-controlled functionality on the products registered with this token—Enables the export-compliance flag if you are in a country that allows for strong encryption. You must select this option now if you plan to use this functionality. If you enable this functionality later, you will need to re-register your device with a new product key and reload the device. If you do not see this option, your account does not support export-controlled functionality.

    The token is added to your inventory.

  4. Click the arrow icon to the right of the token to open the Token dialog box so you can copy the token ID to your clipboard. Keep this token ready for later in the procedure when you need to register the threat defense.

    Figure 2. View Token
    Figure 3. Copy Token

Step 2

In the management center, choose System (system gear icon) > Licenses > Smart Licenses.

Step 3

Click Register.

Step 4

Paste the token you generated from Smart Software Manager into the Product Instance Registration Token field.

Make sure there are no empty spaces or blank lines at the beginning or end of the text.

Step 5

Decide whether to send usage data to Cisco.

  • Enable Cisco Success Network is enabled by default. You can click sample data to see the kind of data Cisco collects. For more information, see Configure Cisco Success Network Enrollment.

  • Enable Cisco Support Diagnostics is disabled by default. You can review the kind of data Cisco collects in the link provided above the check box. For more information, see Configure Cisco Support Diagnostics Enrollment.

    Note

     

    • When enabled, Cisco Support Diagnostics is enabled in the devices in the next sync cycle. The management center sync with the device runs once every 30 minutes.

    • When enabled, Cisco Support Diagnostics is enabled automatically on any new device registered in this management center.

Step 6

Click Apply Changes.

What to do next

Register the Management Center with the Smart Software Manager On-Prem

As described in Periodic Communication with the Smart Software Manager, the management center must communicate regularly with Cisco to maintain your license entitlement. If you have one of the following situations, you might want to use a Smart Software Manager On-Prem (formerly known as "Smart Software Satellite Server") as a proxy for connections to the Smart Software Manager:

  • Your management center is offline or otherwise has limited or no connectivity (in other words, is deployed in an air-gapped network.)

    (For an alternate solution for air-gapped networks, see Licensing Options for Air-Gapped Deployments.)

  • Your management center has permanent connectivity, but you want to manage your Smart Licenses via a single connection from your network.

The Smart Software Manager On-Prem allows you to schedule synchronization or manually synchronize Smart License authorization with the Smart Software Manager.

For more information about the Smart Software Manager On-Prem, see https://www.cisco.com/c/en/us/buy/smart-accounts/software-manager.html#~on-prem

Procedure

Step 1

Deploy and set up Smart Software Manager On-Prem.

Step 2

Register the management center with the Smart Software Manager On-Prem.

  1. Choose Integration > Other Integrations.

  2. Click Smart Software Satellite.

  3. Select Connect to Cisco Smart Software Satellite Server.

  4. Enter the URL of your Smart Software Manager On-Prem, using the CN value you collected in the prerequisites of this procedure, in the following format:

    https://FQDN_or_hostname_of_your_SSM_On-Prem/SmartTransport

    The FQDN or hostname must match the CN value of the certificate presented by your Smart Software Manager On-Prem.

  5. Add a new SSL Certificate and paste the certificate text that you copied earlier.

  6. Click Apply.

  7. Select System > Licenses > Smart Licenses and click Register.

  8. Create a new token on Smart Software Manager On-Prem.

  9. Copy the token.

  10. Paste the token into the form on the management center page.

  11. Click Apply Changes.

    The management center is now registered to Smart Software Manager On-Prem.

Step 3

After you assign licenses to devices, synchronize Smart Software Manager On-Prem to the Smart Software Manager.

See the Smart Software Manager On-Prem documentation, above.

Step 4

Schedule ongoing synchronization times.

Enable the Export Control Feature for Accounts Without Global Permission

If your Smart Account is not authorized for strong encryption, but Cisco has determined that you are allowed to use strong encryption, you can manually add a strong encryption license to your account.

Before you begin

  • Make sure that your deployment does not already support the export-controlled functionality.

    If your deployment supports export-controlled features, you will see an option that allows you to enable export-controlled functionality in the Create Registration Token page in the Smart Software Manager. For more information, see https://www.cisco.com/c/en/us/buy/smart-accounts/software-manager.html.

  • Make sure your deployment is not using an evaluation license.

  • In the Smart Software Manager, on the Inventory > Licenses page, verify that you have the license that corresponds to your management center:

    Export Control License

    Management Center Model

    Cisco Virtual FMC Series Strong Encryption (3DES/AES)

    All management center virtuals

    Cisco FMC 1K Series Strong Encryption (3DES/AES)

    1000, 1600

    Cisco FMC 2K Series Strong Encryption (3DES/AES)

    2500, 2600

    Cisco FMC 4K Series Strong Encryption (3DES/AES)

    4500, 4600

Procedure

Step 1

Choose System > Licenses > Smart Licenses .

Note

 

If you see the Request Export Key, your account is approved for the export-controlled functionality and you can proceed to use the required feature.

Step 2

Click Request Export Key to generate an export key.

Tip

 

If the export control key request fails, make sure that your virtual account has a valid Export Control license.

Disable the export control license by clicking Return Export Key

What to do next

You can now deploy configurations or policies that use the export-controlled features.


Remember

The new export-controlled licenses and all features enabled by it do not take effect on the threat defense devices until the devices are rebooted. Until then, only the features supported by the older license will be active.

In High Availability deployments both the threat defense devices need to be rebooted simultaneously, to avoid an Active-Active condition.

Assign Licenses to Devices

You can assign most licenses when you register a device to the management center. You can also assign licenses per device, or for multiple devices.

Assign Licenses to a Single Device

Although there are some exceptions, you cannot use the features associated with a license if you disable it on a managed device.


Note

For container instances on the same security module/engine, you apply the license to each instance; note that the security module/engine consumes only one license per feature for all instances on the security module/engine.


Note

For the threat defense cluster, you apply the licenses to the cluster as a whole; note that each unit in the cluster consumes a separate license per feature.

Before you begin

You must have Admin or Network Admin privileges to perform this task. When operating with multiple domains, you must do this task in leaf domains.

Procedure

Step 1

Choose Devices > Device Management.

Step 2

Next to the device where you want to assign or disable a license, click Edit (edit icon).

Step 3

Click Device.

Step 4

Next to the License section, click Edit (edit icon).

Step 5

Check or clear the appropriate check boxes to assign or disable licenses for the device.

Step 6

Click Save.

Step 7

Deploy configuration changes; see the Cisco Secure Firewall Management Center Device Configuration Guide.
What to do next

Verify license status: Go to System (system gear icon) > Licenses > Smart Licenses, enter the hostname or IP address of the device into the filter at the top of the Smart Licenses table, and verify that only a green circle with a Check Mark (check mark icon) appears for each device, for each license type. If you see any other icon, hover over the icon for more information.

Assign Licenses to Multiple Managed Devices

Devices managed by the management center obtain their licenses via the management center, not directly from the Smart Software Manager.

Use this procedure to enable licensing on multiple devices at once.


Note

For container instances on the same security module/engine, you apply the license to each instance; note that the security module/engine consumes only one license per feature for all instances on the security module/engine.


Note

For the threat defense cluster, you apply the licenses to the cluster as a whole; note that each unit in the cluster consumes a separate license per feature.

Procedure

Step 1

Choose System (system gear icon) > Licenses > Smart Licenses or Specific Licenses.

Step 2

Click Edit Licenses.

Step 3

For each type of license you want to add to a device:

  1. Click the tab for that type of license.

  2. Click a device in the list on the left.

  3. Click Add to move that device to the list on the right.

  4. Repeat for each device to receive that type of license.

    For now, don't worry about whether you have licenses for all of the devices you want to add.

  5. Repeat this subprocedure for each type of license you want to add.

  6. To remove a license, click the Delete (delete icon) next to the device.

  7. Click Apply.

What to do next

Verify that your licenses are correctly installed. Follow the procedure in Monitoring Smart Licenses.

Manage Smart Licensing

This section describes how to manage Smart Licensing.

Deregister the Management Center

Deregister your management center from the Smart Software Manager to release all of the license entitlements back to your Smart Account so they can be used for other devices. For example, deregister if you need to decommission the management center or reimage it.

See Unregistered State for more information about license enforcement in an unregistered state.

Procedure

Step 1

Choose System (system gear icon) > Licenses > Smart Licenses.

Step 2

Click Deregister (deregister icon).

Synchronize or Reauthorize the Management Center

By default, the ID certificate is automatically renewed every 6 months, and the license entitlement is renewed every 30 days. You might want to manually renew the registration for either of these items if you have a limited window for internet access, or if you make any licensing changes in the Smart Software Manager, for example.

Procedure

Step 1

Choose System (system gear icon) > Licenses > Smart Licenses.

Step 2

To renew the ID certificate, click Synchronize (synchronize icon)

Step 3

To renew the license entitlements, click Re-Authorize.

Monitoring Smart License Status

The Smart License Status section of the System > Licenses > Smart Licenses page provides an overview of license usage on the management center, as described below.

Usage Authorization

Possible status values are:

  • In-compliance (in-compliance icon) — All licenses assigned to managed devices are in compliance and the management center is communicating successfully with the Smart Software Manager.

  • License is in compliance but communication with licensing authority has failed— Device licenses are in compliance, but the management center is not able to communicate with the Cisco licensing authority.

  • Out-of-compliance icon or unable to communicate with License Authority— One or more managed devices is using a license that is out of compliance, or the management center has not communicated with the Smart Software Manager in more than 90 days.

Product Registration

Specifies the last date when the management center contacted the Smart Software Manager and registered.

Assigned Virtual Account

Specifies the Virtual Account under the Smart Account that you used to generate the Product Instance Registration Token and register the management center. If this deployment is not associated with a particular virtual account within your Smart Account, this information is not displayed.

Export-Controlled Features

If this option is enabled, you can deploy restricted features. For details, see Licensing for Export-Controlled Functionality.

Cisco Success Network

Specifies whether you have enabled Cisco Success Network for the management center. If this option is enabled, you provide usage information and statistics to Cisco which are essential to provide you with technical support. This information also allows Cisco to improve the product and make you aware of unused available features so that you can maximize the value of the product in your network. See Configure Cisco Success Network Enrollment for more information.

Monitoring Smart Licenses

To view the license status for the management center and its managed devices, use the Smart Licenses page.

For each type of license in your deployment, the page lists the total number of licenses consumed, whether the license is in compliance or out of compliance, the device type, and the domain and group where the device is deployed. You can also view the management center's Smart License Status. Container instances on the same security module/engine only consume one license per security module/engine. Therefore, even though the management center lists each container instance separately under each license type, the number of licenses consumed for feature license types will only be one.

Other than the Smart Licenses page, there are a few other ways you can view licenses:

Procedure

Step 1

Choose System (system gear icon) > Licenses > Smart Licenses.

Step 2

In the Smart Licenses table, click the arrow at the left side of each License Type folder to expand that folder.

Step 3

In each folder, verify that each device has a green circle with a Check Mark (check mark icon) in the License Status column.

Note

 

If you see duplicate management center virtual licenses, each represents one managed device.

If all devices show a green circle with a Check Mark (check mark icon), your devices are properly licensed and ready to use.

If you see any License Status other than a green circle with a Check Mark (check mark icon), hover over the status icon to view the message.

What to do next

  • If you had any devices that did not have a green circle with a Check Mark (check mark icon), you may need to purchase more licenses.

Troubleshooting Smart Licensing

Expected Licenses Do Not Appear in My Smart Account

If the licenses you expect to see are not in your Smart Account, try the following:

  • Make sure they are not in a different Virtual Account. Your organization's license administrator may need to assist you with this.

  • Check with the person who sold you the licenses to be sure that transfer to your account is complete.

Unable to Connect to Smart License Server

Check the obvious causes first. For example, make sure your management center has outside connectivity. See Internet Access Requirements.

Unexpected Out-of-Compliance Notification or Other Error

  • If a device is already registered to a different management center, you need to deregister the original management center before you can license the device under a new management center. See Deregister the Management Center.

  • Check if the term of the subscription license has expired.

Troubleshoot Other Issues

For solutions to other common issues, see https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/215838-fmc-and-ftd-smart-license-registration-a.html

Convert a Classic License for Use on the Threat Defense

You can convert licenses using either the License Registration Portal or the Smart Software Manager, and you can convert an unused Product Authorization Key (PAK) or a Classic license that has already been assigned to a device.


Note

You cannot undo this process. You cannot convert a Smart License to a Classic license, even if the license was originally a Classic license.

In documentation on Cisco.com, Classic licenses may also be referred to as "traditional" licenses.

Before you begin

  • It is easiest to convert a Classic license to a Smart License when it is still an unused PAK that has not yet been assigned to a product instance.

  • Your hardware must be able to run threat defense. See the Cisco Firepower Compatibility Guide at https://www.cisco.com/c/en/us/support/security/defense-center/products-device-support-tables-list.html.

  • You must have a Smart Account. If you do not have one, create one. See Create a Smart Account and Add Licenses.

  • The PAKs or licenses that you want to convert must appear in your Smart Account.

  • If you convert using the License Registration Portal instead of the Smart Software Manager, you must have your Smart Account credentials in order to initiate the conversion process.

Procedure

Step 1

The conversion process you follow depends on whether or not the license has been consumed:

  • If the PAK that you want to convert has never been used, follow instructions for converting a PAK.

  • If the PAK you want to convert has already been assigned to a device, follow instructions for converting a Classic license.

    Make sure your existing classic license is still registered to your device.

Step 2

See instructions for your type of conversion (PAK or installed Classic license) in the following documentation:

Step 3

Freshly install threat defense on your hardware.

See the instructions for your hardware at https://www.cisco.com/c/en/us/support/security/firepower-ngfw/products-installation-guides-list.html.

Step 4

If you will use the device manager to manage this device as a standalone device:

See information about licensing the device in the device manager configuration guide at https://www.cisco.com/c/en/us/support/security/firepower-ngfw/products-installation-and-configuration-guides-list.html.

Skip the rest of this procedure.

Step 5

If you have already deployed Smart Licensing on your management center:

  1. Set up Smart Licensing on your new threat defense.

    See Assign Licenses to Multiple Managed Devices.

  2. Verify that the new Smart License has been successfully applied to the device.

    See Monitoring Smart Licenses.

Step 6

If you have not yet deployed Smart Licensing on your management center:

See Configure Smart Licensing. (Skip any steps that do not apply or that you have already completed.)

Configure Specific License Reservation (SLR)

You can use the Specific License Reservation feature to deploy Smart Licensing in an air-gapped network.


Note

Various names are used at Cisco for Specific License Reservation, including SLR, SPLR, PLR, and Permanent License Reservation. These terms may also be used at Cisco to refer to similar but not necessarily identical licensing models.

When Specific License Reservation is enabled, the management center reserves licenses from your virtual account for a specified duration without accessing the Smart Software Manager or using Smart Software Manager On-Prem.

Features that require access to the internet, such as URL Lookups or contextual cross-launch to public web sites, will not work.

Cisco does not collect web analytics or telemetry data for deployments that use Specific License Reservation.

Requirements and Prerequisites for Specific License Reservation

  • If you are currently using regular Smart Licensing, de-register the management center before you implement Specific License Reservation. For information, see Deregister the Management Center.

    All Smart Licenses that are currently deployed to the management center will be returned to the pool of available licenses in your account, and you can re-use them when you implement Specific License Reservation.

  • Specific License Reservation uses the same licenses as regular Smart Licensing.

  • (Recommended) If you deploy the management center pair in a high availability configuration, note the following:

    • Configure high availability before you assign licenses. If you already assigned licenses to devices on the secondary management center, be sure to unassign them.

    • If an SLR license is assigned to a primary management center, when the secondary management center becomes active after a failover, you cannot add the SLR license to the secondary management center. You must do one of the following:

      • Perform a failover to make the primary management center active.

      • Unassign and re-assign the license to the secondary management center.

Verify that your Smart Account is Ready to Deploy Specific License Reservation

To prevent problems when deploying your Specific License Reservation, complete this procedure before you make any changes in your management center.

Before you begin

Procedure

Step 1

Sign in to the Smart Software Manager:

https://software.cisco.com/#SmartLicensing-Inventory

Step 2

If applicable, select the correct account from the top right corner of the page.

Step 3

If necessary, click Inventory.

Step 4

Click Licenses.

Step 5

Verify the following:

  • There is a License Reservation button.

  • There are enough platform and feature licenses for the devices and features you will deploy, including management center virtual entitlements for your devices, if applicable.

Step 6

If any of these items is missing or incorrect, contact your account representative to resolve the problem.

Note

 

Do not continue with this process until any problems are corrected.

Enable the Specific Licensing Menu Option

This procedure changes the "Smart Licenses" menu option to "Specific Licenses" in the management center.

Procedure

Step 1

Access the management center console using a USB keyboard and VGA monitor, or use SSH to access the management interface.

Step 2

Log into the management center CLI admin account.

Step 3

Enter the expert command to access the Linux shell.

Step 4

Execute the following command to access the Specific License Reservation options:

sudo manage_slr.pl

Example:


admin@fmc63betaslr: ~$ sudo manage_slr.pl
Password:


**************** Configuration Utility **************

1   Show SLR Status
2   Enable SLR
3   Disable SLR
0   Exit

**************************************************************
Enter choice:

Step 5

Enable Specific License Reservation by selecting option 2.

Step 6

Select option 0 to exit the manage_slr utility.

Step 7

Type exit to exit the Linux shell.

Step 8

Enter exit to exit the command line interface.

Step 9

Verify that you can access the Specific License Reservation page in the management center web interface:

  • If the System > Licenses > Smart Licenses page is currently displayed, refresh the page.

  • Otherwise, choose System > Licenses > Specific Licenses.

Enter the Specific License Reservation Authorization Code into the Management Center

Procedure

Step 1

Generate the reservation request code.

  1. In the management center, choose System > Licenses > Specific Licenses.

  2. Click Generate.

  3. Make a note of the Reservation Request Code.

Step 2

Generate the reservation authorization code.

  1. Go to the Cisco Smart Software Manager: https://software.cisco.com/#SmartLicensing-Inventory

  2. If necessary, select the correct account from the top right of the page.

  3. If necessary, click Inventory.

  4. Click Licenses.

  5. Click License Reservation.

  6. Enter the code that you generated from management center into the Reservation Request Code box.

  7. Click Next.

  8. Select Reserve a specific license.

  9. Scroll down to display the entire License grid.

  10. Under Quantity To Reserve, enter the number of each platform and feature license needed for your deployment.

    Note

     

    • You must explicitly include a Essentials license for each managed device, or, for multi-instance deployments, for each container.

    • If you are using the management center virtual, you must include a platform entitlement for each container (in multi-instance deployments) or each managed device (all other deployments).

    • If you use strong encryption functionality:

      • If your entire Smart Account is enabled for export-controlled functionality, you do not need to do anything here.

      • If your organization's entitlement is per-management center, you must select the appropriate license.

        For the correct license name to choose for your management center, see the prerequisites in Enable the Export Control Feature for Accounts Without Global Permission.

  11. Click Next.

  12. Click Generate Authorization Code.

    At this point, the license is now in use according to the Smart Software Manager.

  13. Download the Authorization Code in preparation for entering it into the management center.

Step 3

Enter the authorization code in the management center.

  1. In the management center, click Browse to upload the text file with the authorization code that you generated from the Smart Software Manager.

  2. Click Install.

  3. Verify that the Specific License Reservation page shows the Usage Authorization status as authorized.

Step 4

Click the Reserved License tab to verify the licenses selected while generating the Authorization Code.

If you do not see the licenses you require, then add the necessary licenses. For more info, see Update the Specific Licenses for Firepower Management Center.

Assign Specific Licenses to Managed Devices

Use this procedure to quickly assign licenses to multiple managed devices at one time.

You can also use this procedure to disable or move licenses from one device to another. If you disable a license for a device, you cannot use the features associated with that license on that device.

Procedure

Step 1

Choose System > Licenses > Specific Licenses.

Step 2

Click Edit Licenses.

Step 3

Click each tab and assign licenses to devices as needed.

Step 4

Click Apply.

Step 5

Click the Assigned Licenses tab and verify that your licenses are correctly installed on each device.

Step 6

Deploy configuration changes; see the Cisco Secure Firewall Management Center Device Configuration Guide.

Manage Specific License Reservation

This section describes how to manage Specific License Reservation.

Important! Maintain Your Specific License Reservation Deployment

To update the threat data and software that keep your deployment effective, see Maintain Your Air-Gapped Deployment.

To ensure that all functionality continues to work without interruption, monitor your license expiration dates (on the Reserved Licenses tab). If any of the licenses expire, the management center will be in the Out of Compliance state if the usage count is greater than the available count.

Update a Specific License Reservation

After you have successfully deployed Specific Licenses on your management center, you can add or remove entitlements at any time using this procedure.

Use this procedure if you need to renew your licenses after they expire. If you do not have the required licenses, the following actions are restricted:

  • Device registration

  • Policy deployment

Procedure

Step 1

In the management center, obtain the unique product instance identifier of this management center:

  1. Select System > Licenses > Specific Licenses.

  2. Make a note of the Product Instance value.

    You will need this value several times during this process.

Step 2

In the Smart Software Manager, identify the management center to update:

  1. Go to the Smart Software Manager:

    https://software.cisco.com/#SmartLicensing-Inventory

  2. If necessary, click Inventory.

  3. Click Product Instances.

  4. Look for a product instance that has FP in the Type column and a generic SKU (not a hostname) in the Name column. You may also be able to use the values in other table columns to help determine which management center is the correct management center. Click the name.

  5. Look at the UUID and see if it is the UUID of the management center that you are trying to modify.

    If not, you must repeat these steps until you find the correct management center.

Step 3

When you have located the correct management center in the Smart Software Manager, update the reserved licenses and generate a new authorization code:

  1. On the page that shows the correct UUID, choose Actions > Update Reserved Licenses.

  2. Update the reserved licenses as needed.

    Note

     

    • You must explicitly include a Essentials license for each managed device, or, for multi-instance deployments, for each container.

    • If you are using the management center virtual, you must include a platform entitlement for each container (in multi-instance deployments) or each managed device (all other deployments).

    • If you use strong encryption functionality:

      • If your entire Smart Account is enabled for export-controlled functionality, you do not need to do anything here.

      • If your organization's entitlement is per-management center, you must select the appropriate license.

        For the correct license name to choose for your management center, see the prerequisites in Enable the Export Control Feature for Accounts Without Global Permission.

  3. Click Next and verify the details.

  4. Click Generate Authorization Code.

  5. Download the Authorization Code in preparation for entering it into the management center.

  6. Leave the Update Reservation page open. You will return to it later in this procedure.

Step 4

Update the Specific Licenses in the management center.

  1. Choose System > Licenses > Specific Licenses.

  2. Click Edit SLR.

  3. Click Browse to upload the newly generated authorization code.

  4. Click Install to update the licenses.

    After successful installation of the authorization code, ensure that the licenses shown in the Reserved column of management center, matches with the licenses that you have reserved in the Smart Software Manager.

  5. Make a note of the Confirmation Code.

Step 5

Enter the confirmation code in the Smart Software Manager:

  1. Return to the Smart Software Manager page that you left open earlier in this procedure.

  2. Choose Actions > Enter Confirmation Code:

  3. Enter the confirmation code that you generated from the management center.

Step 6

In the management center, verify that your licenses are reserved as you expect them, and that each feature for each managed device shows a green circle with a Check Mark (check mark icon).

If necessary, see Monitoring Specific License Reservation Status for more information.

Step 7

Deploy configuration changes; see the Cisco Secure Firewall Management Center Device Configuration Guide.

Deactivate and Return the Specific License Reservation

If you no longer need a specific license, you must return it to your Smart Account. If you want to register your Smart Licensing account, you must disable the Specific License Reservation (Step 6 of the procedure below).


Important

If you do not follow all of the steps in this procedure, the license remains in an in-use state and cannot be re-used.

This procedure releases all license entitlements associated with the management center back to your virtual account. After you de-register, no updates or changes on licensed features are allowed.

Procedure

Step 1

In the management center Web interface, select System > Licenses > Specific Licenses.

Step 2

Make a note of the Product Instance identifier for this management center.

Step 3

Generate a return code from the management center.

  1. Click Return SLR.

    The following figure shows Return SLR.

    Devices become unlicensed and the management center moves to the de-registered state.

  2. Make a note of the Return Code.

Step 4

In the Smart Software Manager, identify the management center to deregister:

  1. Go to the Smart Software Manager:

    https://software.cisco.com/#SmartLicensing-Inventory

  2. If necessary, click Inventory.

  3. Click Product Instances.

  4. Look for a product instance that has FP in the Type column and a generic SKU (not a hostname) in the Name column. You may also be able to use the values in other table columns to help determine which management center is the correct management center. Click the name.

  5. Look at the UUID and see if it is the UUID of the management center that you are trying to modify.

    If not, you must repeat these steps until you find the correct management center.

Step 5

When you have identified the correct management center, return the licenses to your Smart Account:

  1. On the page that shows the correct UUID, choose Actions > Remove.

  2. Enter the reservation return code that you generated from the management center into the Remove Product Instance dialog box.

  3. Click Remove Product Instance.

    The specific reserved licenses are returned to the available pool in your Smart Account and this management center is removed from the Smart Software Manager Product Instances list.

Step 6

Disable the Specific License in the management center Linux shell:

  1. Access the management center console using a USB keyboard and VGA monitor, or use SSH to access the management interface.

  2. Log in to the management center CLI admin account. This gives you access to the command line interface.

  3. Enter the expert command to access the Linux shell.

  4. Execute the following command:

    sudo manage_slr.pl

    Example:
    
admin@fmc63betaslr: ~$ sudo manage_slr.pl
Password:


**************** Configuration Utility **************

1   Show SLR Status
2   Enable SLR
3   Disable SLR
0   Exit

**************************************************************
Enter choice:

  5. Select menu option 3 to disable the Specific License Reservation.

  6. Select option 0 to exit the manage_slr utility.

  7. Enter exit to exit the Linux shell.

  8. Enter exit to exit the command line interface.

Monitoring Specific License Reservation Status

Usage Authorization

The System > Licenses > Specific Licenses page provides an overview of license usage on the management center, as described below.

Possible status values are:

  • Authorized — The management center is in compliance and registered successfully with the License Authority, which has authorized the license entitlements for the appliance.

  • Out-of-compliance — If licenses are expired or if the management center has overused licenses even though they are not reserved, status shows as Out-of-Compliance. License entitlements are enforced in Specific License Reservation, so you must take action.

Product Registration

Specifies registration status and the date that an authorization code was last installed or renewed on the management center.

Export-Controlled Features

Specifies whether you have enabled export-controlled functionality for the management center.

For more information about Export-Controlled Features, see Licensing for Export-Controlled Functionality.

Product Instance

The Universally Unique Identifier (UUID) of this management center. This value identifies this device in the Smart Software Manager.

Confirmation Code

The Confirmation Code is needed if you update or deactivate and return Specific Licenses.

Assigned Licenses Tab

Shows the licenses assigned to each device and the status of each.

Reserved Licenses Tab

Shows the number of licenses used and available to be assigned, and license expiration dates.

Troubleshoot Specific License Reservation

How do I identify a particular management center in the Product Instance list in Smart Software Manager?

On the Product Instances page in Smart Software Manager, if you cannot identify the product instance based on a value in one of the columns in the table, you must click the name of each generic product instance of type FP to view the product instance details page. The UUID value on this page uniquely identifies one management center.

In the management center web interface, the UUID for the management center is the Product Instance value displayed on the System > Licenses > Specific Licenses page.

I do not see a License Reservation button in the Smart Software Manager

If you do not see the License Reservation button, then your account is not authorized for Specific License Reservation. If you have already enabled Specific License Reservation in the Linux shell and generated a request code, perform the following:

  1. If you have already generated a Request Code in the management center web interface, cancel the request code.

  2. Disable Specific License Reservation in the management center Linux shell as described within the section Deactivate and Return the Specific License Reservation.

  3. Register the management center with the Smart Software Manager in regular mode using smart token.

  4. Contact Cisco TAC to enable Specific License for your smart account.

I was interrupted in the middle of the licensing process. How can I pick up where I left off?

If you have generated but not yet downloaded an Authorization code from the Smart Software Manager, you can go to the Product Instance page in the Smart Software Manager, click the product instance, then click Download Reservation Authorization Code.

I am unable to register devices to the management center virtual

Make sure you have enough management center virtual entitlements in your Smart Account to cover the devices you want to register, then update your deployment to add the necessary entitlements.

See Update a Specific License Reservation.

I have enabled Specific Licensing, but now I do not see a Smart License page.

This is the expected behavior. When you enable Specific Licensing, Smart Licensing is disabled. You can use the Specific License page to perform licensing operations.

If you want to use Smart Licensing, you must return the Specific License. For more information see, Deactivate and Return the Specific License Reservation.

What if I do not see a Specific License page in the management center virtual?

You need to enable Specific License to view the Specific License page. For more information see, Enable the Specific Licensing Menu Option.

I have disabled Specific Licensing, but forgot to copy the Return Code. What should I do?

The Return Code is saved in the management center virtual. You must re-enable the Specific License from the Linux shell (see Enable the Specific Licensing Menu Option), then refresh the management center virtual web interface. Your Return Code will be displayed.

Configure Legacy Management Center PAK-Based Licenses

The management center supports either a Smart License or a legacy PAK (Product Activation Key) license for its platform license. This procedure describes how to apply a PAK-based license.

After re-registration of your Smart Account, you must manually add the classic licenses for all classic devices.

Before you begin

  • Make sure you have the product activation key (PAK) from the Software Claim Certificate that Cisco provided when you purchased the license. If you have a legacy, pre-Cisco license, contact Support.

Procedure

Step 1

The license key uniquely identifies the management center in the Smart Software Manager. It is composed of a product code (for example, 66) and the MAC address of the management port (eth0) of the management center; for example, 66:00:00:77:FF:CC:88.

  1. Choose System (system gear icon) > Licenses > Classic Licenses.

  2. Click Add New License.

  3. Note the value in the License Key field at the top of the Add Feature License dialog.

Step 2

Choose System (system gear icon) > Licenses > Classic Licenses.

Step 3

Click Add New License.

Step 4

Continue as appropriate:

  • If you have already obtained the license text, skip to Step 8.
  • If you still need to obtain the license text, go to the next step.

Step 5

Click Get License to open the License Registration Portal.

Note

 

If you cannot access the Internet using your current computer, switch to a computer that can, and browse to http://cisco.com/go/license.

Step 6

Generate a license from the PAK in the License Registration Portal: https://cisco.com/go/license.

This step requires the PAK you received during the purchase process, as well as the license key for the management center.

For more information on using this portal, see:

https://slexui.cloudapps.cisco.com/SWIFT/LicensingUI/Quickstart

You will need your account credentials in order to access these links.

Step 7

Copy the license text from either the License Registration Portal display, or the email the License Registration Portal sends you.

Important

 

The licensing text block in the portal or email message may include more than one license. Each license is bounded by a BEGIN LICENSE line and an END LICENSE line. Make sure that you copy and paste only one license at a time.

Step 8

Return to the Add Feature License page in the management center virtual’s web interface.

Step 9

Paste the license text into the License field.

Step 10

Click Verify License.

If the license is invalid, make sure that you correctly copied the license text.

Step 11

Click Submit License.

History for Licenses

Feature

Minimum Management Center

Minimum Threat Defense

Details

Smart Licensing Standardization

7.3

Any

We changed the following license names in the management center GUI:

  • Base is now Essentials

  • Threat is now IPS

  • Malware is now Malware Defense

  • RA VPN/AnyConnect License is now Cisco Secure Client

  • AnyConnect Plus is now Secure Client Advantage

  • AnyConnect Apex is now Secure Client Premier

  • AnyConnect Apex and Plus is now Secure Client Premier and Advantage

  • AnyConnect VPN Only is now Secure Client VPN Only

Support for Carrier license

7.3

Any

The Carrier license enables inspection of Diameter, GTP/GPRS, SCTP, and M3UA protocols.

New/Modified screens: System > Smart Licenses

Performance tier licensing for the threat defense virtual

7.0

Any

Performance-tiered licensing provides different throughput levels and VPN connection limits based on deployment requirements. License tiers map to new threat defense virtual models.

Licensing for multi-instance capability for the threat defense on the Firepower 4100/9300

6.3

Any

You can now deploy multiple threat defense container instances on a Firepower 4100/9300. You only need a single license per feature per security module/engine. The base license is automatically assigned to each instance.

New/Modified screens: System > Licenses > Smart Licenses

Supported platforms: threat defense on the Firepower 4100/9300

Specific License Reservation for air-gapped deployments

6.3

Any

Customers whose deployments cannot connect to the internet to communicate with the Cisco License Authority can use a Specific License Reservation.

New/Modified screens: System > Licenses > Specific Licenses (This option is not available by default.)

Supported platforms: management center, threat defense

Export-controlled functionality for restricted customers

6.3

Any

Certain customers whose Smart Accounts are not otherwise eligible to use restricted functionality can purchase term-based licenses, with approval.

Supported platforms: management center, threat defense